CVE-2026-44423 ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data

Medium 6.5 Published 13 May 2026 Updated 14 May 2026

An authenticated user can read SSH session data belonging to other tenants due to missing tenant scoping in the session API.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-44423?

CVE-2026-44423 is a medium-severity missing authorization vulnerability in shellhub-io shellhub, published on 13 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by the caller's tenant. An authenticated user can read session records (SSH username, device UID, remote IP, terminal type, authenticated flag, timestamps) belonging to any other namespace. This vulnerability is fixed in 0.24.2.

Weakness: CWE-639

Which versions are affected by CVE-2026-44423?

3 open source packages ship an affected version, including github.com/shellhub-io/shellhub. It affects 1 product.

Package	Affected	Fixed in
`github.com/shellhub-io/shellhub` Go	All versions	`0.24.2`
`github.com/shellhub-io/shellhub` Go	All versions	`0.24.2`
`github.com/shellhub-io/shellhub` Go	All versions	`0.24.2`

Products include Shellhub Shellhub.

How do I fix CVE-2026-44423?

Upgrade github.com/shellhub-io/shellhub to 0.24.2 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-44423 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44423 exists.

Sources

Also known as GHSA-9w9c-9w8m-w89q, GO-2026-5302.