CVE-2026-82448CWE-798hardcoded-credentials

CVE-2026-82448

Critical · published August 29, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
52.6
In the wild
Unconfirmed
What it is

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00697 · 52.6th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-08-29T17:16Z
References (5)
https://gitlab.com/Shinobi-Systems/Shinobi · [email protected]https://gitlab.com/Shinobi-Systems/Shinobi/-/blob/f04e685b8bd4c6190fcd62993131b86a76c2b806/libs/childNode/utils.js · [email protected]https://gitlab.com/Shinobi-Systems/Shinobi/-/commit/5a76c74f3977661ff3f9fd55a260db352c0b19c0 · [email protected]https://gitlab.com/Shinobi-Systems/Shinobi/-/merge_requests/554 · [email protected]https://www.vulncheck.com/advisories/shinobi-before-commit-5a76c74f-arbitrary-database-query-execution-via-hardcoded-child-node-key · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 29 AUG 12:05Z
    Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key
    cvelistv5