Medium
ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data
Type: advisorySources: OSV
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by the caller's tenant. An authenticated user can read session records (SSH username, device UID, remote IP, terminal type, authenticated flag, timestamps) belonging to any other namespace. This vulnerability is fixed in 0.24.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-44423
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 18:30 UTC · Revision 1
Source evidence
ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data
core-osv · Original sourcePublished 13 May 2026, 21:07 UTC
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by the caller's tenant. An authenticated user can read session records (SSH username, device UID, remote IP, terminal type, authenticated flag, timestamps) belonging to any other namespace. This vulnerability is fixed in 0.24.2.
osv:CVE-2026-44423
Complete source record
{
"id": "80d15b5146390345a262ccd5de4f3cc709fdc07e56c8ab57a52618b02b23b0fc",
"url": "https://osv.dev/vulnerability/CVE-2026-44423",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data",
"summary": "ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated caller, without scoping by the caller's tenant. An authenticated user can read session records (SSH username, device UID, remote IP, terminal type, authenticated flag, timestamps) belonging to any other namespace. This vulnerability is fixed in 0.24.2.",
"evidence": "osv:CVE-2026-44423",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-44423",
"aliases": [
"CVE-2026-44423",
"GHSA-9w9c-9w8m-w89q",
"GO-2026-5302"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/shellhub-io/shellhub",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "2e5002fff1b1ef5f6c86557065ce9fda3c2579f4"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.24.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"cpe": "cpe:2.3:a:shellhub:shellhub:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.24.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v0.23.0",
"v0.21.5",
"v0.24.1",
"v0.24.0",
"v0.24.0-rc.1",
"v0.23.0-rc.4",
"v0.23.0-rc.3",
"v0.23.0-rc.2",
"v0.23.0-rc.1",
"v0.22.0",
"v0.22.0-rc.2",
"v0.22.0-rc.1",
"v0.21.4",
"v0.21.3",
"v0.21.2",
"v0.21.1",
"v0.21.0",
"v0.21.0-rc.5",
"v0.21.0-rc.4",
"v0.21.0-rc.3",
"v0.21.0-rc.2",
"v0.21.0-rc.1",
"v0.20.1",
"v0.20.1-rc.1",
"v0.20.0",
"v0.20.0-rc.5",
"v0.20.0-rc.4",
"v0.20.0-rc.3",
"v0.20.0-rc.2",
"v0.20.0-rc.1",
"v0.19.2",
"v0.19.2-rc.2",
"v0.19.2-rc.1",
"v0.19.1",
"v0.19.1-rc.2",
"v0.19.1-rc.1",
"v0.19.0",
"v0.19.0-rc.9",
"v0.19.0-rc.8",
"v0.19.0-rc.7",
"v0.19.0-rc.6",
"v0.19.0-rc.5",
"v0.19.0-rc.4",
"v0.19.0-rc.3",
"v0.19.0-rc.2",
"v0.19.0-rc.1",
"v0.18.3",
"v0.18.2",
"v0.18.2-rc.2",
"v0.18.2-rc.1",
"v0.18.1",
"v0.18.0",
"v0.18.0-rc.7",
"v0.18.0-rc.6",
"v0.18.0-rc.5",
"v0.18.0-rc.4",
"v0.18.0-rc.3",
"v0.18.0-rc.2",
"v0.18.0-rc.1",
"v0.17.2",
"v0.17.2-rc.3",
"v0.17.2-rc.2",
"v0.17.2-rc.1",
"v0.17.1",
"v0.17.1-rc.1",
"v0.17.0",
"v0.17.0-rc.4",
"v0.17.0-rc.3",
"v0.17.0-rc.2",
"v0.17.0-rc.1",
"v0.16.0",
"v0.16.0-rc.2",
"v0.16.0-rc.1",
"v0.15.2-rc.1",
"v0.15.1",
"v0.15.1-rc.3",
"v0.15.1-rc.2",
"v0.15.1-rc.1",
"v0.15.0",
"v0.15.0-rc.6",
"v0.15.0-rc.5",
"v0.15.0-rc.4",
"v0.15.0-rc.3",
"v0.15.0-rc.2",
"v0.15.0-rc.1",
"v0.14.3",
"v0.14.3-rc.1",
"v0.14.2",
"v0.14.1",
"v0.14.0",
"v0.14.0-rc.7",
"v0.14.0-rc.6",
"v0.14.0-rc.5",
"v0.14.0-rc.4",
"v0.14.0-rc.3",
"v0.14.0-rc.2",
"v0.14.0-rc.1",
"v0.13.6",
"v0.13.6-rc.3",
"v0.13.6-rc.2",
"v0.13.6-rc.1",
"v0.13.5",
"v0.13.5-rc.2",
"v0.13.5-rc.1",
"v0.13.4",
"api/v0.13.4",
"v0.13.4-rc.2",
"v0.13.4-rc.1",
"v0.13.3",
"v0.13.3-rc.1",
"v0.13.2",
"api/v0.13.2",
"v0.13.1",
"v0.13.0",
"api/v0.13.0",
"v0.13.0-rc.12",
"api/v0.13.0-rc.12",
"v0.13.0-rc.11",
"api/v0.13.0-rc.11",
"api/v0.13.0-rc.10",
"v0.13.0-rc.10",
"v0.13.0-rc.9",
"v0.13.0-rc.8",
"v0.13.0-rc.7",
"v0.13.0-rc.6",
"v0.13.0-rc.5",
"v0.13.0-rc.4",
"v0.13.0-rc.3",
"v0.13.0-rc.2",
"v0.13.0-rc.1",
"v0.12.5",
"v0.12.5-rc.11",
"v0.12.5-rc.10",
"v0.12.5-rc.9",
"v0.12.5-rc.8",
"v0.12.5-rc.7",
"v0.12.5-rc.6",
"v0.12.5-rc.5",
"v0.12.5-rc.4",
"v0.12.5-rc.3",
"v0.12.5-rc.2",
"v0.12.5-rc.1",
"v0.12.4",
"v0.12.4-rc.5",
"v0.12.4-rc.4",
"v0.12.4-rc.3",
"v0.12.4-rc.2",
"v0.12.4-rc.1",
"api/v0.12.4-rc.1",
"v0.12.3",
"v0.12.2",
"v0.12.2-rc.6",
"v0.12.2-rc.5",
"v0.12.2-rc.4",
"v0.12.2-rc.3",
"v0.12.2-rc.2",
"v0.12.2-rc.1",
"v0.12.1",
"v0.12.1-rc.3",
"v0.12.1-rc.2",
"v0.12.1-rc.1",
"api/v0.12.1-rc.1",
"v0.12.0",
"v0.12.0-rc.4",
"v0.12.0-rc.3",
"v0.12.0-rc.2",
"v0.12.0-rc.1",
"v0.11.8",
"v0.11.8-rc.5",
"v0.11.8-rc.4",
"v0.11.8-rc.3",
"v0.11.8-rc.2",
"v0.11.8-rc.1",
"v0.11.7",
"v0.11.7-rc.8",
"v0.11.7-rc.7",
"v0.11.7-rc.6",
"v0.11.7-rc.5",
"v0.11.7-rc.4",
"v0.11.7-rc.3",
"v0.11.7-rc.2",
"v0.11.7-rc.1",
"v0.11.6",
"v0.11.5",
"v0.11.4",
"v0.11.3",
"v0.11.3-rc.2",
"v0.11.3-rc.1",
"v0.11.2",
"v0.11.2-rc.1",
"v0.11.1",
"v0.11.1-rc.1",
"v0.11.0",
"v0.11.0-rc.8",
"v0.11.0-rc.7",
"v0.11.0-rc.6",
"v0.11.0-rc.5",
"v0.11.0-rc.4",
"v0.11.0-rc.3",
"v0.11.0-rc.2",
"v0.11.0-rc.1",
"v0.10.10",
"v0.10.10-rc.3",
"v0.10.10-rc.2",
"v0.10.10-rc.1",
"v0.10.9",
"v0.10.9-rc.3",
"v0.10.9-rc.2",
"v0.10.9-rc.1",
"v0.10.8",
"v0.10.8-rc.1",
"v0.10.7",
"v0.10.7-rc.5",
"v0.10.7-rc.4",
"v0.10.7-rc.3",
"v0.10.7-rc.2",
"v0.10.7-rc.1",
"v0.10.6",
"v0.10.5",
"v0.10.5-rc.3",
"v0.10.5-rc.2",
"v0.10.5-rc.1",
"v0.10.2",
"v0.10.2-rc.2",
"v0.10.2-rc.1",
"v0.10.1",
"v0.10.1-rc.1",
"v0.10.0",
"v0.10.0-rc.3",
"v0.10.0-rc.2",
"v0.10.0-rc.1",
"v0.9.6-rc.2",
"v0.9.6-rc.1",
"v0.9.3",
"v0.9.3-rc.4",
"v0.9.3-rc.3",
"v0.9.3-rc.2",
"v0.9.3-rc.1",
"v0.9.2",
"v0.9.2-rc.2",
"v0.9.2-rc.1",
"v0.9.1",
"v0.9.1-rc.8",
"v0.9.1-rc.7",
"v0.9.1-rc.6",
"v0.9.1-rc.5",
"v0.9.1-rc.4",
"v0.9.1-rc.3",
"v0.9.1-rc.2",
"v0.9.1-rc.1",
"api/v0.9.1-rc.1",
"v0.9.0",
"v0.8.3-rc.5",
"v0.8.3-rc.4",
"v0.8.3-rc.3",
"v0.8.3-rc.2",
"v0.8.3-rc.1",
"v0.8.2",
"api/v0.8.2",
"v0.8.2-rc.6",
"v0.8.2-rc.5",
"v0.8.2-rc.4",
"v0.8.2-rc.3",
"api/v0.8.2-rc.3",
"v0.8.2-rc.2",
"v0.8.2-rc.1",
"v0.8.1",
"v0.8.0-rc.7",
"v0.8.0-rc.6",
"v0.8.0-rc.5",
"v0.8.0-rc.4",
"v0.8.0-rc.3",
"v0.8.0-rc.2",
"v0.8.0-rc.1",
"v0.7.3",
"v0.7.2",
"v0.7.1-rc.3",
"v0.7.1-rc.2",
"v0.7.1-rc.1",
"v0.7.0",
"api/v0.7.0",
"v0.6.4",
"api/v0.6.4",
"v0.6.3",
"api/v0.6.3",
"v0.6.2",
"api/v0.6.2",
"v0.6.1",
"api/v0.6.1",
"v0.6.0",
"api/v0.6.0",
"v0.6.0-rc.3",
"v0.6.0-rc.2",
"v0.5.3-rc.5",
"v0.6.0-rc.1",
"v0.5.3-rc.4",
"v0.5.3-rc.3",
"v0.5.3-rc.2",
"v0.5.3-rc.1",
"v0.5.2",
"v0.5.1",
"v0.5.0-rc.4",
"v0.5.0",
"v0.5.0-rc.3",
"v0.5.0-rc.2",
"v0.5.0-rc.1",
"v0.4.3-rc.1",
"api/v0.4.3-rc.1",
"v0.4.2",
"api/v0.4.2",
"v0.4.1",
"v0.4.0",
"v0.3.4",
"v0.3.3",
"v0.3.2",
"v0.3.1",
"v0.3.0",
"v0.2.6",
"v0.2.5",
"v0.2.4",
"v0.3.0-rc.2",
"v0.2.3",
"v0.3.0-rc.1",
"v0.2.2",
"v0.2.1",
"v0.2.0",
"v0.1.1",
"v0.1.0",
"v0.0.5",
"v0.0.4",
"v0.0.3",
"v0.0.2",
"v0.0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44423.json"
}
}
],
"modified": "2026-10-28T02:30:38.424739572Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44423.json",
"https://github.com/shellhub-io/shellhub/security/advisories/GHSA-9w9c-9w8m-w89q",
"https://nvd.nist.gov/vuln/detail/CVE-2026-44423"
],
"provider_metadata": {
"cwe_ids": [
"CWE-639"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44423.json"
}
},
"related_cves": [
{
"value": "CVE-2026-44423",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 505716,
"published_at": "2026-05-13T21:07:33.174+00:00"
}