CVE-2026-44426CWE-639

ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check

Medium · published May 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/namespaces/:tenant returns the full namespace object — including

the members list (user IDs, e-mails, roles), settings, and device counts — to any caller authenticated by an API Key, for any tenant, regardless of the API Key's own tenant scope. The handler conditionally skips the membership check when the user ID (X-ID) is absent, which is exactly the case for API Key authentication. This vulnerability is fixed in 0.24.2.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-13T21:06Z
EPSS history
Timeline
  • 13 MAY 21:06Z
    ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check
    cvelistv5