Search

Find a vulnerability

Search criteria

    2 vulnerabilities by moul

    CVE-2026-111638 (GCVE-0-2026-111638)

    Vulnerability from nvd – Published: 2026-10-16 17:39 – Updated: 2026-10-16 17:39
    VLAI
    Title
    sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys
    Summary
    sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.
    Severity
    8.3 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
    7.7 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    CWE
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6373 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    moul sshportal Affected: 0 , ≤ 1.19.5 (custom)
    		Create a notification for this product.
    Date Public
    2026-10-15 00:00
    Credits
    hieuPenguinnn
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/moul/sshportal",
          "product": "sshportal",
          "repo": "https://github.com/moul/sshportal",
          "vendor": "moul",
          "versions": [
            {
              "lessThanOrEqual": "1.19.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell \u0027key show\u0027 command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like \u0027default\u0027 or \u0027host\u0027 to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T17:39:09.600Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/sshportal-key-show-privkey-disclosure"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/moul/sshportal/blob/v1.19.5/pkg/bastion/shell.go#L1513-L1584"
        },
        {
          "name": "VulnCheck Advisory: sshportal through 1.19.5 Missing Authorization in \u0027key show\u0027 Command Exposes Private Keys",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/sshportal-through-1.19.5-missing-authorization-in-key-show-command-exposes-private-keys"
        }
      ],
      "title": "sshportal through 1.19.5 Missing Authorization in \u0027key show\u0027 Command Exposes Private Keys",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111638",
    "datePublished": "2026-10-16T17:39:09.600Z",
    "dateReserved": "2026-10-16T14:31:13.189Z",
    "dateUpdated": "2026-10-16T17:39:09.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-111638 (GCVE-0-2026-111638)

    Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-16 17:39
    VLAI
    Title
    sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys
    Summary
    sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.
    Severity
    8.3 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
    7.7 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
    CWE
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6373 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    moul sshportal Affected: 0 , ≤ 1.19.5 (custom)
    		Create a notification for this product.
    Date Public
    2026-10-15 00:00
    Credits
    hieuPenguinnn
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/moul/sshportal",
          "product": "sshportal",
          "repo": "https://github.com/moul/sshportal",
          "vendor": "moul",
          "versions": [
            {
              "lessThanOrEqual": "1.19.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell \u0027key show\u0027 command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like \u0027default\u0027 or \u0027host\u0027 to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T17:39:09.600Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/sshportal-key-show-privkey-disclosure"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/moul/sshportal/blob/v1.19.5/pkg/bastion/shell.go#L1513-L1584"
        },
        {
          "name": "VulnCheck Advisory: sshportal through 1.19.5 Missing Authorization in \u0027key show\u0027 Command Exposes Private Keys",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/sshportal-through-1.19.5-missing-authorization-in-key-show-command-exposes-private-keys"
        }
      ],
      "title": "sshportal through 1.19.5 Missing Authorization in \u0027key show\u0027 Command Exposes Private Keys",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111638",
    "datePublished": "2026-10-16T17:39:09.600Z",
    "dateReserved": "2026-10-16T14:31:13.189Z",
    "dateUpdated": "2026-10-16T17:39:09.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}