CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:LCVE-2026-44425
Medium (5.4) in shellhub shellhub. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/shellhub-io/shellhub 0.24.2.
ShellHub is a centralized SSH gateway. Prior to 0.24.2, the device list endpoint accepts user-controlled identifiers in the the name field of each filter property in the base64-encoded filter query parameter and the sort_by query parameter, which are then passed directly as BSON/SQL keys in the database layer without validation. Any authenticated user can craft payloads that cause the aggregation / query to fail and the API to return HTTP 500 with no body, with no rate limiting applied. This vulnerability is fixed in 0.24.2.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-20, CWE-943, CWE-1333
- Published
- Modified
- Record from
- the NVD, synced
Affected
- shellhub:shellhub
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-47r2-v3x6-wff9 | Go | github.com/shellhub-io/shellhub | <0.24.2 | 0.24.2 |
| GO-2026-5113 | Go | github.com/shellhub-io/shellhub | <0.24.2 | 0.24.2 |