github.com/shellhub-io/shellhub (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/shellhub-io/shellhub, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2026-44423 — CVSS 6.5 (medium): ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/sessions/:uid returns the full session object for any authenticated…
• CVE-2026-44424 — CVSS 6.5 (medium): ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/devices/:uid returns the full device object whenever the caller is…
• CVE-2026-44426 — CVSS 6.5 (medium): ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET /api/namespaces/:tenant returns the full namespace object — including the…
• CVE-2026-44425 — CVSS 5.4 (medium): ShellHub is a centralized SSH gateway. Prior to 0.24.2, the device list endpoint accepts user-controlled identifiers in the the name field…