CVE-2026-111638
7.7HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-862
Impact
Authenticated non-admin users can dump decrypted backend private SSH keys using the management shell. This allows attackers to connect directly to backend hosts, bypassing ACLs and session recording.
Root cause
The management shell's 'key show' command fails to enforce authorization checks, allowing any user to view sensitive private key material.
Affected systems
sshportal through 1.19.5
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Fix & remediation
Upgrade to a fixed version once released; if no patch is immediately available, restrict access to the management shell or revoke direct network access to backend hosts from untrusted client networks.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.