PT-2026-38314 · Shellhub · Shellhub

Published 2026-05-06 · Updated 2026-05-14 · CVE-2026-44424

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ShellHub versions prior to 0.24.2

Description An issue exists where the endpoint "/api/devices/:uid" returns the full device object to any authenticated user without verifying if the device belongs to the caller's namespace (tenant). An authenticated user possessing a JWT or API Key who knows or can guess a device uid can read device metadata from other namespaces. This leads to cross-tenant disclosure of information such as hostnames, MAC addresses, OS fingerprints, public SSH keys, namespace names, last-seen timestamps, and remote addresses, which can be used for namespace enumeration and device inventory reconnaissance.

Recommendations Update to version 0.24.2.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-44424

GHSA-J72X-XFWG-783F

Affected Products

Shellhub

References · 6

• 🔥 https://github.com/shellhub-io/shellhub/security/advisories/GHSA-j72x-xfwg-783f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44424 · Security Note
• https://osv.dev/vulnerability/GHSA-j72x-xfwg-783f · Vendor Advisory
• https://github.com/shellhub-io/shellhub · Note
• https://t.me/CVEtracker/53713 · Telegram Post
• https://twitter.com/CVEnew/status/2054709201122058646 · Twitter Post