CVE-2026-44426: ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check

May 7, 2026 (updated May 14, 2026)

GET /api/namespaces/:tenant returns the full namespace object — including the members list (user IDs, e-mails, roles), settings, and device counts — to any caller authenticated by an API Key, for any tenant, regardless of the API Key’s own tenant scope.

The handler conditionally skips the membership check when the user ID (X-ID) is absent, which is exactly the case for API Key authentication.

References

github.com/advisories/GHSA-vwx9-7qcf-gg7f
github.com/shellhub-io/shellhub/security/advisories/GHSA-vwx9-7qcf-gg7f
nvd.nist.gov/vuln/detail/CVE-2026-44426

Code Behaviors & Features

Detect and mitigate CVE-2026-44426 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →