Threats affecting pkg:github/shellhub-io/shellhub

ShellHub versions prior to 0.24.2 contain an authorization bypass vulnerability where authenticated users can access full session objects belonging to other tenants. This allows reading sensitive session details such as SSH usernames, device UIDs, remote IPs, terminal types, authentication flags, and timestamps without proper tenant scoping. The issue is addressed in version 0.24.2.

CVE-2026-44424 is an authorization bypass vulnerability in shellhub versions prior to 0.24.2. The issue occurs because the API endpoint GET /api/devices/:uid returns full device metadata to any authenticated user without verifying device ownership within the caller's namespace. This allows an authenticated user with a valid JWT or API key to access device information from other tenants if they know or can guess the device UID. The vulnerability has a CVSS score of 6.5 (medium severity) and is fixed in version 0.24.2.

ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e-mails, roles), settings, and device counts — to any caller authenticated by an API Key, for any tenant, regardless of the API Key's own tenant scope. The handler conditionally skips the membership check when the user ID (X-ID) is absent, which is exactly the case for API Key authentication. This vulnerability is fixed in 0.24.2.

ShellHub is a centralized SSH gateway. Prior to 0.24.2, the device list endpoint accepts user-controlled identifiers in the the name field of each filter property in the base64-encoded filter query parameter and the sort_by query parameter, which are then passed directly as BSON/SQL keys in the database layer without validation. Any authenticated user can craft payloads that cause the aggregation / query to fail and the API to return HTTP 500 with no body, with no rate limiting applied. This vulnerability is fixed in 0.24.2.