CVE-2026-111638: Missing Authorization in moul sshportal

CVE-2026-111638 describes a missing authorization vulnerability in moul's sshportal product through version 1.19.5. The vulnerability exists in the management shell 'key show' command, which does not properly restrict access to decrypted backend private SSH keys. Authenticated users without administrative privileges can exploit this by requesting predictable key names, thereby obtaining private keys. This unauthorized access allows attackers to connect directly to backend hosts, circumventing ACLs and session recording, which compromises the security controls intended to restrict and monitor access.

An attacker with valid non-admin credentials can retrieve decrypted private SSH keys, enabling unauthorized direct access to backend hosts. This bypasses ACL enforcement and session recording, potentially leading to undetected lateral movement or data exfiltration within the affected environment. The vulnerability has a high severity rating with a CVSS 4.0 score of 8.3, reflecting the significant risk posed by unauthorized access to critical SSH keys.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the management shell to trusted administrators only and monitor for unauthorized use of the 'key show' command. Consider implementing compensating controls such as enhanced logging and network segmentation to limit potential impact.