Live › vulnerability › CVE-2026-111638
Go to dashboardsshportal through 1.19.5 (every release): the management shell 'key show' command has no admin role check and prints the decrypted private key. Any authenticated non-admin user can run 'key show default' or 'key show host' (or use numeric IDs) and read the SSH client keys sshportal uses for backend hosts. They can then log in to those hosts directly, bypassing ACLs and session recording. No fix is published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running sshportal 1.19.5 or earlier as an SSH bastion where some users have accounts but are not admins. Any user who can log in to the management interface can reach the flaw, and backend keys are exposed with it, so rotate those keys after patching. Deployments where every account is an admin are not exposed in the same way.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| sshportal | go | <= 1.19.5 | – |
1.19.5 is affected, and that is every release. 2) As a non-admin user run: ssh -p 2222 <your-username>@bastion key show defaultPrivate Key line is printed, you are exposed. 3) Check shell logs for key show calls by non-admin usersv1.19.5 is affected)default and host SSH client keys and any other sshportal-managed key, re-authorize the new public keys on backend hosts, and restrict who has accountsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.
This page as .md · .json · in your agent: get_signal("CVE-2026-111638")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.