Nixpkgs security tracker
NIXPKGS-2026-1587
GitHub issue
published 1 month, 1 week ago
Permalink
CVE-2026-44424
6.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse accepted
- @LeSuisse published on GitHub
ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespace
ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/devices/:uid returns the full device object whenever the caller is authenticated, without verifying that the device belongs to the caller's namespace (tenant). Any authenticated user (JWT or API Key) who knows or can guess a device UID can read device metadata from any other namespace. This vulnerability is fixed in 0.24.2.
References
-
https://github.com/shellhub-io/shellhub/security/advisories/GHSA-j72x-xfwg-783f x_refsource_CONFIRM
Affected products
shellhub
- ==< 0.24.2
Matching in nixpkgs
pkgs.shellhub-agent
Enables easy access any Linux device behind firewall and NAT
Package maintainers
-
@otavio Otavio Salvador <otavio.salvador@ossystems.com.br>