{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asshportalsshportal/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sshportal:sshportal:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-111638"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["sshportal (\u003c= 1.19.5)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["sshportal"],"content_html":"\u003cp\u003esshportal versions 1.19.5 and earlier are affected by a missing authorization vulnerability within the management shell component, specifically tied to the 'key show' command. This flaw permits authenticated users, who lack administrative privileges, to successfully request and view decrypted backend private SSH keys. By querying for predictable key identifiers, such as 'default' or 'host', an attacker can extract sensitive credentials used by the system to communicate with backend infrastructure. The exposure of these keys effectively negates the security posture of the platform, as it permits the attacker to establish direct connections to backend hosts, thereby circumventing configured access control lists (ACLs) and evading centralized session recording mechanisms. This vulnerability (CVE-2026-111638) highlights a critical failure in enforcing role-based access control within the management interface.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-111638 allows unauthorized lateral movement and direct access to backend systems. This bypasses the security auditing and recording features of the sshportal gateway, creating a significant risk of data exfiltration and persistent unauthorized access to managed infrastructure. Organizations relying on sshportal to broker access to critical backend assets are at risk of complete compromise of these assets if any authenticated user account is hijacked or malicious.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade sshportal to the latest patched version beyond 1.19.5 immediately to remediate CVE-2026-111638.\u003c/li\u003e\n\u003cli\u003eAudit logs for the management shell interface to identify anomalous 'key show' command usage by non-administrative user accounts.\u003c/li\u003e\n\u003cli\u003eReview and rotate any backend private SSH keys that may have been accessible to non-admin users during the period of exposure.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:47:33Z","date_published":"2026-10-16T18:47:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sshportal-auth-bypass/","summary":"An authorization vulnerability in the sshportal management shell allows authenticated non-admin users to retrieve decrypted backend private SSH keys and bypass access controls.","title":"Authorization Bypass in sshportal Management Shell","url":"https://feed.craftedsignal.io/briefs/2026-10-sshportal-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:sshportal:sshportal:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}