CVE-2026-44423 — ShellHub is a centralized SSH gateway. Prior to 0.24.2, GET

title: CVE-2026-44423 - ShellHub Unscoped Session Access
id: scw-2026-05-13-ai-1
status: experimental
level: high
description: |
  Detects attempts to access session data via the '/api/sessions/:uid' endpoint in ShellHub versions prior to 0.24.2. This vulnerability allows any authenticated user to retrieve session details (like SSH username, device UID, remote IP) from any namespace, indicating potential unauthorized data access.
author: SCW Feed Engine (AI-generated)
date: 2026-05-13
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-44423/
tags:
  - attack.persistence
  - attack.t1133
logsource:
    category: webserver
detection:
  selection:
      cs-method:
          - 'GET'
      uri|startswith:
          - '/api/sessions/'
      cs-uri-query|contains:
          - 'uid='
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse