6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44426

CVE-2026-44426: ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check

ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e-mails, roles), settings, and device counts — to any caller authenticated by an API Key, for any tenant, regardless of the API Key's own tenant scope. The handler conditionally skips the membership check when the user ID (X-ID) is absent, which is exactly the case for API Key authentication. This vulnerability is fixed in 0.24.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44426

CVE-2026-44426:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/shellhub-io/shellhub	go	<= 0.24.1	0.24.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-vwx9-7qcf-gg7f, is a cross-tenant Insecure Direct Object Reference (IDOR) in ShellHub. The root cause was a missing authorization check in several API endpoints that handle namespace management. When a request was authenticated using an API key, the system would not have a user ID (X-ID) in the request context. The code in multiple handlers incorrectly skipped membership and tenancy checks if the user ID was absent. This allowed an attacker, authenticated with an API key from their own tenant, to perform actions on any other tenant's namespace by simply knowing the victim's tenant UUID.

The analysis of the patch fe8e2bdf830a1cd765d5f73a13b09b4137db260e confirms this. The fix introduces a new middleware, RequiresTenant, which is applied to the affected routes. This middleware ensures that the tenant ID from the caller's authentication context matches the tenant ID specified in the API request path.

The following functions were identified as vulnerable because they were modified to include this new tenancy check, or had logic added to scope data to the caller's tenant:

routes.Handler.GetNamespace: The original reported vulnerability. It allowed unauthorized disclosure of a namespace's details, including member information.
routes.Handler.EditNamespace: Allowed unauthorized modification of a namespace.
routes.Handler.DeleteNamespace: Allowed unauthorized deletion of a namespace.
routes.Handler.EditSessionRecordStatus: Allowed unauthorized changes to the session recording setting of a namespace.
services.service.ListNamespaces (called by routes.Handler.GetNamespaceList): Allowed an API key user to enumerate all namespaces across the entire ShellHub instance, instead of just their own.

These functions would appear in a runtime profile or stack trace during the exploitation of this vulnerability. The fix involves enforcing strict tenant-based authorization at the routing layer for specific actions and modifying the service layer logic for list operations.

Vulnerable functions

routes.Handler.GetNamespace

api/routes/routes.go

This function was vulnerable to an Insecure Direct Object Reference (IDOR). It failed to verify that the tenant ID in the request URL matched the tenant ID of the authenticated caller (especially when using an API key). This allowed an attacker to retrieve sensitive namespace information, including member details, from any tenant.

routes.Handler.EditNamespace

api/routes/routes.go

This function was vulnerable to a cross-tenant IDOR. It did not enforce that the caller's tenant scope matched the tenant being modified, allowing an authenticated user to alter the settings of another tenant's namespace.

routes.Handler.DeleteNamespace

api/routes/routes.go

This function was vulnerable to a cross-tenant IDOR. It lacked a check to ensure the authenticated caller was authorized for the target tenant, which could allow an attacker to delete another tenant's namespace.

routes.Handler.EditSessionRecordStatus

api/routes/routes.go

This function was vulnerable to a cross-tenant IDOR. It allowed an authenticated user to change the session recording status for any namespace, not just their own, because it failed to validate the caller's tenancy against the target namespace.

services.service.ListNamespaces

api/services/namespace.go

This service function, called by the `GetNamespaceList` handler, did not properly scope the list of namespaces for API key-based authentication. This allowed a user with an API key to enumerate all namespaces across the entire system, instead of being restricted to their own tenant.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.