MEDIUM5.4Go
GHSA-47r2-v3x6-wff9· CVE-2026-44425, GO-2026-5113ShellHub has crash-DoS via field injection in filter and sort-by parameters
Modified: 6/25/2026
package
Go/github.com/shellhub-io/shellhub
pkg:go/github.com/shellhub-io/shellhub
—Go
GO-2026-5680· CVE-2026-44426, GHSA-vwx9-7qcf-gg7fShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check in github.com/shellhub-io/shellhub
Modified: 6/25/2026
MEDIUM6.5Go
GHSA-9w9c-9w8m-w89q· CVE-2026-44423, GO-2026-5302ShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data
Modified: 7/21/2026
MEDIUM6.5Go
GHSA-j72x-xfwg-783f· CVE-2026-44424, GO-2026-5453ShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace
Modified: 6/25/2026
MEDIUM6.5Go
GHSA-vwx9-7qcf-gg7f· CVE-2026-44426, GO-2026-5680ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check
Modified: 6/25/2026
—Go
GO-2026-5113· CVE-2026-44425, GHSA-47r2-v3x6-wff9ShellHub has crash-DoS via field injection in filter and sort-by parameters in github.com/shellhub-io/shellhub
Modified: 6/25/2026
—Go
GO-2026-5302· CVE-2026-44423, GHSA-9w9c-9w8m-w89qShellHub has cross-tenant IDOR in `GET /api/sessions/:uid` that discloses SSH session data in github.com/shellhub-io/shellhub
Modified: 6/25/2026
—Go
GO-2026-5453· CVE-2026-44424, GHSA-j72x-xfwg-783fShellHub has cross-tenant IDOR in `GET /api/devices/:uid` that discloses device data of any namespace in github.com/shellhub-io/shellhub
Modified: 6/25/2026