CVE-2026-44426 - Vulnerability Analysis

Overview

ShellHub < 0.24.2 contains an information disclosure vulnerability caused by improper tenant membership checks in GET /api/namespaces/:tenant, letting API key authenticated attackers access full namespace details of any tenant, exploit requires API key authentication.

Severity & Score

Impact

Attackers with any API key can access sensitive tenant information including user IDs, emails, roles, and settings across tenants.

Mitigation

Update to version 0.24.2 or later.

References

• https://github.com/shellhub-io/shellhub/security/advisories/GHSA-vwx9-7qcf-gg7f

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner