PT-2026-38405 · Shellhub · Shellhub

Edu0X01 · Published 2026-05-07 · Updated 2026-05-14 · CVE-2026-44426

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ShellHub versions prior to 0.24.2

Description An issue exists where the endpoint "/api/namespaces/:tenant" returns the complete namespace object to any caller authenticated via an API Key, regardless of the API Key's tenant scope. This object includes sensitive information such as the members list (user IDs, e-mails, and roles), settings, and device counts. The problem occurs because the handler skips the membership check when the user ID variable X-ID is absent, which is the standard behavior for API Key authentication. This allows for the enumeration of any namespace by tenant UUID and the disclosure of member details and namespace configurations.

Recommendations Update to version 0.24.2.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-44426

GHSA-VWX9-7QCF-GG7F

Affected Products

Shellhub

References · 7

• 🔥 https://github.com/shellhub-io/shellhub/security/advisories/GHSA-vwx9-7qcf-gg7f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44426 · Security Note
• https://osv.dev/vulnerability/GHSA-vwx9-7qcf-gg7f · Vendor Advisory
• https://github.com/shellhub-io/shellhub · Note
• https://twitter.com/CVEnew/status/2054709202292261109 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2054806550431088869 · Twitter Post
• https://t.me/CVEtracker/53715 · Telegram Post