CVE-2026-82448: Shinobi Child Node SQL Injection Vulnerability

CVE-2026-82448 is a SQL injection vulnerability in Shinobi's child node service caused by a hardcoded connection key. Attackers can execute arbitrary database queries to access user data and camera settings. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-82448 Overview

CVE-2026-82448 affects Shinobi, an open-source video management platform, in versions prior to commit 5a76c74f. The child node service embeds a hardcoded connection key that unauthenticated network attackers can present during the WebSocket handshake. Once accepted, the attacker dispatches arbitrary SQL statements through the onWebSocketDataFromChildNode handler. This grants read and write access to user records and camera configuration data stored in the Shinobi database. The weakness is classified under CWE-798: Use of Hard-coded Credentials.

Critical Impact
Unauthenticated attackers with network access to the child node port can read and modify Shinobi user accounts and camera configuration by executing arbitrary SQL through the WebSocket handler.

Affected Products

Shinobi (all versions prior to commit 5a76c74f3977661ff3f9fd55a260db352c0b19c0)
Shinobi child node service (libs/childNode/utils.js)
Shinobi deployments exposing the child node WebSocket port

Discovery Timeline

2026-08-29 - CVE-2026-82448 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82448

Vulnerability Analysis

Shinobi supports a distributed architecture in which child nodes connect back to the main service over WebSocket. The child node service authenticates incoming WebSocket handshakes using a connection key. In vulnerable builds, that key is embedded directly in source code within libs/childNode/utils.js rather than derived from a per-deployment secret. Any actor who reads the public repository knows the key.

After completing the handshake, the client can transmit messages that are routed to the onWebSocketDataFromChildNode handler. That handler executes SQL provided by the caller against the Shinobi database. There is no additional authorization layer, no query allowlist, and no separation between control-plane commands and raw database operations.

Root Cause

The root cause is the use of hard-coded credentials [CWE-798]. Because the key is a compile-time constant in an open-source project, it cannot function as a shared secret. The design also conflates authenticated child-node RPC with unrestricted SQL execution, so a single credential failure exposes the full database.

Attack Vector

Exploitation requires only network reachability to the child node WebSocket listener. An attacker connects to the port, presents the hardcoded key during the handshake, and issues crafted messages containing SQL statements. The handler executes them and returns results. Attackers can enumerate accounts, alter passwords or roles, add administrative users, and rewrite camera configuration to disable recording or redirect video streams.

For implementation specifics, see the Shinobi Utils.js source code and the VulnCheck advisory.

Detection Methods for CVE-2026-82448

Indicators of Compromise

Unexpected inbound WebSocket connections to the Shinobi child node port from untrusted networks.
New or modified rows in the Shinobi Users table, particularly administrative accounts not created by operators.
Camera configuration changes, including altered stream URLs, disabled recording, or new monitors added outside normal workflows.
Application logs showing calls to onWebSocketDataFromChildNode originating from unknown remote hosts.

Detection Strategies

Inspect network flow data for connections to the child node WebSocket port from sources outside the documented parent-child topology.
Enable database query logging on the MySQL/MariaDB backend and alert on UPDATE, INSERT, or DELETE statements against Users and camera tables during unusual hours.
Compare running Shinobi commit against 5a76c74f using git rev-parse HEAD to confirm patched status.

Monitoring Recommendations

Forward Shinobi application and database logs to a centralized logging or SIEM platform for correlation and retention.
Alert on administrative user creation events and any modification of authentication material within the Shinobi database.
Baseline expected child-node source IPs and alert on deviations.

How to Mitigate CVE-2026-82448

Immediate Actions Required

Update Shinobi to a build that includes commit 5a76c74f or later.
Block external access to the child node WebSocket port at the network perimeter and restrict it to trusted parent-node IPs.
Rotate all Shinobi user credentials and audit the Users table for unauthorized accounts.
Review camera configurations for tampering, including stream endpoints and recording settings.

Patch Information

The vulnerability is remediated in Shinobi commit 5a76c74f3977661ff3f9fd55a260db352c0b19c0, delivered through Merge Request #554. Operators should pull from the Shinobi Systems GitLab repository and redeploy. Verify the deployed commit hash after upgrading.

Workarounds

Bind the child node service to a private management interface and enforce firewall rules limiting access to authorized parent nodes.
Place Shinobi behind a VPN or zero-trust proxy to eliminate direct internet exposure of management ports.
If child-node functionality is unused, disable it in the Shinobi configuration to remove the attack surface entirely.

bash

# Restrict child node WebSocket port to trusted parent node IPs (example: port 8080)
iptables -A INPUT -p tcp --dport 8080 -s <parent_node_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP

# Verify Shinobi is running the patched commit
cd /opt/shinobi && git rev-parse HEAD