CVE-2026-44425: CWE-20: Improper Input Validation in shellhub-io shellhub
ShellHub is a centralized SSH gateway. Prior to 0.24.2, the device list endpoint accepts user-controlled identifiers in the the name field of each filter property in the base64-encoded filter query parameter and the sort_by query parameter, which are then passed directly as BSON/SQL keys in the database layer without validation. Any authenticated user can craft payloads that cause the aggregation / query to fail and the API to return HTTP 500 with no body, with no rate limiting applied. This vulnerability is fixed in 0.24.2.
AI Analysis
Technical Summary
CVE-2026-44425 affects ShellHub, a centralized SSH gateway, in versions before 0.24.2. The device list endpoint accepts user-controlled identifiers in the name field of each filter property within a base64-encoded filter query parameter and the sort_by query parameter. These inputs are passed directly as BSON/SQL keys in the database layer without proper validation, leading to query failures and HTTP 500 errors. The vulnerability requires authenticated access and has no rate limiting. It is classified under CWE-20 (Improper Input Validation), CWE-943, and CWE-1333. The issue is resolved in ShellHub version 0.24.2.
Potential Impact
The vulnerability allows any authenticated user to cause the device list API to fail by sending crafted input, resulting in denial of service through HTTP 500 errors. There is no impact on confidentiality or integrity of data. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade ShellHub to version 0.24.2 or later, where this vulnerability is fixed. Since the vulnerability requires authenticated access, ensure that user access controls are properly enforced. Patch status is confirmed fixed in 0.24.2.
CVE-2026-44425: CWE-20: Improper Input Validation in shellhub-io shellhub
Description
ShellHub is a centralized SSH gateway. Prior to 0.24.2, the device list endpoint accepts user-controlled identifiers in the the name field of each filter property in the base64-encoded filter query parameter and the sort_by query parameter, which are then passed directly as BSON/SQL keys in the database layer without validation. Any authenticated user can craft payloads that cause the aggregation / query to fail and the API to return HTTP 500 with no body, with no rate limiting applied. This vulnerability is fixed in 0.24.2.
CVSS v3.1
Score 5.4medium
Affected software
pkg:github/shellhub-io/shellhubRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-44425 affects ShellHub, a centralized SSH gateway, in versions before 0.24.2. The device list endpoint accepts user-controlled identifiers in the name field of each filter property within a base64-encoded filter query parameter and the sort_by query parameter. These inputs are passed directly as BSON/SQL keys in the database layer without proper validation, leading to query failures and HTTP 500 errors. The vulnerability requires authenticated access and has no rate limiting. It is classified under CWE-20 (Improper Input Validation), CWE-943, and CWE-1333. The issue is resolved in ShellHub version 0.24.2.
Potential Impact
The vulnerability allows any authenticated user to cause the device list API to fail by sending crafted input, resulting in denial of service through HTTP 500 errors. There is no impact on confidentiality or integrity of data. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade ShellHub to version 0.24.2 or later, where this vulnerability is fixed. Since the vulnerability requires authenticated access, ensure that user access controls are properly enforced. Patch status is confirmed fixed in 0.24.2.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-06T14:40:00.953Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a04f25dcbff5d8610127f4f
Added to database: 05/13/2026, 21:51:25 UTC
Last enriched: 05/21/2026, 12:15:59 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 105
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.