PT-2026-38313 · Shellhub · Shellhub

Published 2026-05-06 · Updated 2026-05-14 · CVE-2026-44423

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ShellHub versions prior to 0.24.2

Description An issue exists where the endpoint "/api/sessions/:uid" returns the full session object to any authenticated caller without restricting the results to the caller's tenant. This allows an authenticated user to access session records from any other namespace, including the SSH username, device UID, remote IP, terminal type, authenticated flag, and timestamps. The flaw is located in the GetSession() function, which resolves the session by UID without applying a tenant filter.

Recommendations Update to version 0.24.2. As a temporary workaround, restrict access to the "/api/sessions/:uid" endpoint to minimize the risk of unauthorized data disclosure.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-44423

GHSA-9W9C-9W8M-W89Q

Affected Products

Shellhub

References · 6

• 🔥 https://github.com/shellhub-io/shellhub/security/advisories/GHSA-9w9c-9w8m-w89q · Exploit
• https://osv.dev/vulnerability/GHSA-9w9c-9w8m-w89q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44423 · Security Note
• https://github.com/shellhub-io/shellhub · Note
• https://t.me/CVEtracker/53712 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2054803990664081763 · Twitter Post