Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by the caller's tenant. An authenticated user can read session records (SSH username, device UID, remote IP, terminal type, authenticated flag, timestamps) belonging to any other namespace. This vulnerability is fixed in 0.24.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-44423 Unauthorized Cross-Tenant Session Data Access in ShellHub Prior to 0.24.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44423
Post summary
CVE‑2026‑44423 discloses an unauthorized cross‑tenant session data access vulnerability in ShellHub versions prior to 0.24.2, with no PoC, exploit, or patch information provided.
CVE-2026-44423 ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by the ca… https://www.cve.org/CVERecord?id=CVE-2026-44423
Post summary
The text announces a CVE impacting ShellHub, describing how any authenticated user can retrieve full session data without proper authorization, but provides no PoC, exploit tool, or patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | shellhub | shellhub | - | - | - |