Authorization Bypass in sshportal Management Shell

sshportal versions 1.19.5 and earlier are affected by a missing authorization vulnerability within the management shell component, specifically tied to the 'key show' command. This flaw permits authenticated users, who lack administrative privileges, to successfully request and view decrypted backend private SSH keys. By querying for predictable key identifiers, such as 'default' or 'host', an attacker can extract sensitive credentials used by the system to communicate with backend infrastructure. The exposure of these keys effectively negates the security posture of the platform, as it permits the attacker to establish direct connections to backend hosts, thereby circumventing configured access control lists (ACLs) and evading centralized session recording mechanisms. This vulnerability (CVE-2026-111638) highlights a critical failure in enforcing role-based access control within the management interface.

Impact

Successful exploitation of CVE-2026-111638 allows unauthorized lateral movement and direct access to backend systems. This bypasses the security auditing and recording features of the sshportal gateway, creating a significant risk of data exfiltration and persistent unauthorized access to managed infrastructure. Organizations relying on sshportal to broker access to critical backend assets are at risk of complete compromise of these assets if any authenticated user account is hijacked or malicious.

Recommendation

• Upgrade sshportal to the latest patched version beyond 1.19.5 immediately to remediate CVE-2026-111638.
• Audit logs for the management shell interface to identify anomalous 'key show' command usage by non-administrative user accounts.
• Review and rotate any backend private SSH keys that may have been accessible to non-admin users during the period of exposure.