CVE-2026-44426 ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check
Attackers with any API key can read full namespace details for any tenant, bypassing membership checks in ShellHub SSH gateway.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44426?
CVE-2026-44426 is a medium-severity missing authorization vulnerability in shellhub-io shellhub, published on 13 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e-mails, roles), settings, and device counts — to any caller authenticated by an API Key, for any tenant, regardless of the API Key's own tenant scope. The handler conditionally skips the membership check when the user ID (X-ID) is absent, which is exactly the case for API Key authentication. This vulnerability is fixed in 0.24.2.
Weakness: CWE-639
Which versions are affected by CVE-2026-44426?
3 open source packages ship an affected version, including github.com/shellhub-io/shellhub. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/shellhub-io/shellhub Go | All versions | 0.24.2 |
github.com/shellhub-io/shellhub Go | All versions | 0.24.2 |
github.com/shellhub-io/shellhub Go | All versions | 0.24.2 |
Products include Shellhub Shellhub.
How do I fix CVE-2026-44426?
Upgrade github.com/shellhub-io/shellhub to 0.24.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-44426 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44426 exists.
Other vulnerabilities in shellhub-io shellhub
Sources
Also known as GHSA-vwx9-7qcf-gg7f, GO-2026-5680.