Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/shellhub-io/shellhub

4 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 4 medium
Registry
pkg.go.dev

Advisories 4

  • CVE-2026-44423Medium 6.5

    ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data

    Affected: fixed in 0.24.2.

  • CVE-2026-44424Medium 6.5

    ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespace

    Affected: fixed in 0.24.2.

  • CVE-2026-44426Medium 6.5

    ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check

    Affected: fixed in 0.24.2.

  • CVE-2026-44425Medium 5.4

    ShellHub: Crash-DoS via field injection in filter and sort-by parameters

    Affected: fixed in 0.24.2.