CVE-2026-44425: ShellHub DOS Vulnerability

CVE-2026-44425 Overview

CVE-2026-44425 is an input validation vulnerability in ShellHub, a centralized Secure Shell (SSH) gateway used to manage fleets of remote devices. Versions prior to 0.24.2 accept user-controlled identifiers in the name field of each filter property within the base64-encoded filter query parameter, as well as in the sort_by query parameter, on the device list endpoint. The API passes these values directly as BSON or SQL keys to the database layer without validation. Any authenticated user can submit crafted payloads that cause the aggregation or query to fail, returning HTTP 500 responses with no rate limiting in place. The issue is fixed in ShellHub 0.24.2 and is tracked under [CWE-20].

Critical Impact

Authenticated users can repeatedly trigger backend query failures on the device list endpoint, degrading API availability with no rate limiting to throttle abuse.

Affected Products

• ShellHub versions prior to 0.24.2
• ShellHub centralized SSH gateway deployments exposing the device list endpoint
• Self-hosted ShellHub instances accepting authenticated API requests

Discovery Timeline

• 2026-05-13 - CVE-2026-44425 published to the National Vulnerability Database (NVD)
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44425

Vulnerability Analysis

The vulnerability resides in the device list endpoint of the ShellHub API. The endpoint accepts a base64-encoded filter query parameter containing an array of filter objects. Each object exposes a name field used as a database key. The endpoint also accepts a sort_by query parameter used to order results.

ShellHub passes both values directly into the database layer as BSON or SQL keys without sanitizing or whitelisting allowed identifiers. An authenticated user can supply arbitrary or malformed identifiers, causing the underlying aggregation pipeline or SQL query to throw an error. The API surfaces this error as an HTTP 500 response with an empty body.

Because the endpoint applies no rate limiting, an authenticated attacker can issue these failing requests in volume. Repeated failures consume backend resources and degrade availability for legitimate tenants.

Root Cause

The root cause is improper input validation [CWE-20] of user-controlled identifiers used as database field names. ShellHub trusts client-supplied filter and sort key names and forwards them unchanged to the query builder. A safe implementation would whitelist allowed field names against a known schema before constructing the query.

Attack Vector

Exploitation requires network access to the ShellHub API and valid authenticated credentials. The attacker constructs a base64-encoded filter payload where the name field contains an invalid or unexpected identifier, or supplies a malformed sort_by value. Sending the request to the device list endpoint forces the database layer to fail. No special privileges beyond standard user authentication are required.

Detailed exploitation specifics are documented in the ShellHub GitHub Security Advisory.

Detection Methods for CVE-2026-44425

Indicators of Compromise

• Bursts of HTTP 500 responses with empty bodies originating from the device list endpoint
• Authenticated API requests containing unusual or non-schema name values inside base64-decoded filter parameters
• Requests using unexpected sort_by values that do not match documented sortable fields

Detection Strategies

• Decode and inspect the filter query parameter from API access logs and compare name fields against an allowlist of known device attributes
• Alert on high ratios of HTTP 500 responses to total requests on the device list endpoint from a single authenticated principal
• Correlate authenticated user identifiers with error-response volume to identify abusive accounts

Monitoring Recommendations

• Enable verbose API and database error logging on ShellHub backend services to capture query-builder failures
• Forward ShellHub API logs into a centralized analytics platform and build dashboards tracking 5xx rates per endpoint and per user
• Track aggregation and query failure metrics from the underlying database to detect repeated malformed queries

How to Mitigate CVE-2026-44425

Immediate Actions Required

• Upgrade ShellHub to version 0.24.2 or later, which includes validation of filter and sort identifiers
• Audit existing authenticated accounts and revoke credentials that are no longer needed to reduce the attack surface
• Review API access logs for prior abuse of the device list endpoint with malformed filter or sort_by values

Patch Information

The maintainers fixed the issue in ShellHub 0.24.2. Operators should upgrade self-hosted deployments to this version or newer. Refer to the ShellHub GitHub Security Advisory GHSA-47r2-v3x6-wff9 for full remediation details.

Workarounds

• Place ShellHub behind a reverse proxy or API gateway that enforces per-user rate limiting on the device list endpoint
• Restrict access to the ShellHub API to trusted networks or VPN clients until the upgrade is applied
• Use a web application firewall rule to reject requests whose decoded filter payloads contain name values outside the expected schema

# Example nginx rate limit applied to the ShellHub API
http {
    limit_req_zone $binary_remote_addr zone=shellhub_api:10m rate=10r/s;

    server {
        location /api/devices {
            limit_req zone=shellhub_api burst=20 nodelay;
            proxy_pass http://shellhub_backend;
        }
    }
}