Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 19:49:25 +0000 CVE-2026-44424 — ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespace https://cve.radiocsirt.org/vuln/cve-2026-44424 <p><strong>Affected:</strong> shellhub-io shellhub</p> <p>ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/devices/:uid returns the full device object whenever the caller is authenticated, without verifying that the device belongs to the caller&#39;s namespace (tenant). Any authenticated user (JWT or API Key) who knows or can guess a device UID can read device metadata from any other namespace. This vulnerability is fixed in 0.24.2.</p> <p><strong>Affected:</strong> shellhub-io shellhub</p> <p>ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/devices/:uid returns the full device object whenever the caller is authenticated, without verifying that the device belongs to the caller&#39;s namespace (tenant). Any authenticated user (JWT or API Key) who knows or can guess a device UID can read device metadata from any other namespace. This vulnerability is fixed in 0.24.2.</p> https://cve.radiocsirt.org/vuln/cve-2026-44424