Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e-mails, roles), settings, and device counts — to any caller authenticated by an API Key, for any tenant, regardless of the API Key's own tenant scope. The handler conditionally skips the membership check when the user ID (X-ID) is absent, which is exactly the case for API Key authentication. This vulnerability is fixed in 0.24.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-44426 Information Disclosure in ShellHub Prior to 0.24.2 via API Key Authentication https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44426
Post summary
The text announces CVE-2026-44426, describing an information disclosure vulnerability in ShellHub versions prior to 0.24.2 that exploits API key authentication, but it provides no PoC, exploit, patch, or evidence of active exploitation.
CVE-2026-44426 ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e-mails,… https://www.cve.org/CVERecord?id=CVE-2026-44426
Post summary
ShellHub's pre‑0.24.2 release exposes the full namespace object—including user IDs and emails—when querying /api/namespaces/:tenant, revealing a disclosed vulnerability (CVE‑2026‑44426) but lacking any PoC, exploit code, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | shellhub | shellhub | - | - | - |