{"id":"CVE-2026-111638","kind":"vulnerability","aliases":["CVE-2026-111638"],"related":[],"title":"sshportal: non-admin users can read decrypted backend SSH private keys","description":"sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.","summary":"sshportal through 1.19.5 (every release): the management shell 'key show' command has no admin role check and prints the decrypted private key. Any authenticated non-admin user can run 'key show default' or 'key show host' (or use numeric IDs) and read the SSH client keys sshportal uses for backend hosts. They can then log in to those hosts directly, bypassing ACLs and session recording. No fix is published.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sshportal","fixed":[],"affected":"<= 1.19.5","ecosystem":"go"}],"ecosystems":[],"tags":["authz","credential-disclosure","other","self-hosted","ssh-bastion","sshportal"],"not_affected_if":["admin-only-accounts","no-management-shell-access","no-non-admin-users","single-admin-only"],"how_to_check":"1) Run sshportal --version, or check the image tag; <= 1.19.5 is affected, and that is every release. 2) As a non-admin user run: ssh -p 2222 <your-username>@bastion 'key show default'. If a 'Private Key' line is printed, you are exposed. 3) Check shell logs for key show calls by non-admin users.","fix":"No patched release as of 2026-10-25 (latest v1.19.5 is affected). Rotate the 'default' and 'host' SSH client keys and any other sshportal-managed key, re-authorize the new public keys on backend hosts, and restrict who has accounts. Upstream fix: unknown; a CheckRoles admin guard on key show would settle it.","status":"open","published_at":"2026-10-16T18:17:44+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:02:34+00:00","updated_at":"2026-10-25T03:45:51+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-25T03:02:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"sshportal: non-admin users can read decrypted backend SSH private keys","impact":"high","summary":"sshportal through 1.19.5 has a missing authorization check in the management shell 'key show' command. An authenticated non-admin user can retrieve decrypted private SSH keys for backend hosts by requesting predictable key names such as 'default' or 'host'.","category":"other","nicknames":[],"who_cares":["sshportal","self-hosted","ssh-bastion"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker gets decrypted backend SSH keys and connects to hosts directly","analyst_note":"Find a fixed sshportal version and the upstream advisory or commit; the sources give no fix version or check command.","how_to_check":"- Run `sshportal --version` or check the deployed image tag and compare it with `1.19.5`\n- Check whether non-admin users have access to the management shell and can run `key show`","needs_analyst":true,"not_affected_if":["admin-only-accounts","no-management-shell-access"],"who_is_affected":"Teams running sshportal 1.19.5 or earlier as an SSH bastion where some users have accounts but are not admins. Any user who can log in to the management interface can reach the flaw, and backend keys are exposed with it, so rotate those keys after patching. Deployments where every account is an admin are not exposed in the same way.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000597,"input_tokens":3335,"output_tokens":527,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find a fixed sshportal version and the upstream advisory or commit; the sources give no fix version or check command.","search":"'-111638':15A,18A '-2026':14A,17A '1.19.5':34B,104C 'acl':94B,152C 'admin':4A,45B,58B,122C 'allow':118C 'attack':131C 'authent':55B,119C 'author':108C 'authz':20B 'backend':9A,82B,127C,149C 'bastion':30B 'bypass':93B,151C 'check':47B 'client':77B 'command':42B,116C 'connect':146C 'contain':105C 'credenti':22B 'credential-disclosur':21B 'cve':13A,16A 'decrypt':8A,51B,126C 'default':64B,138C 'direct':92B,147C 'disclosur':23B 'everi':35B 'fix':99B 'host':27B,68B,83B,91B,140C,150C 'id':72B 'key':12A,40B,53B,62B,66B,78B,114C,130C,135C,144C 'like':137C 'log':87B 'manag':38B,112C 'miss':107C 'name':136C 'non':3A,57B,121C 'non-admin':2A,56B,120C 'numer':71B 'obtain':125C 'predict':134C 'print':49B 'privat':11A,52B,128C,143C 'publish':101B 'read':7A,74B 'record':97B,155C 'releas':36B 'request':133C 'retriev':142C 'role':46B 'run':61B 'self':26B 'self-host':25B 'session':96B,154C 'shell':39B,113C 'show':41B,63B,67B,115C 'ssh':10A,29B,76B,129C 'ssh-bastion':28B 'sshportal':1A,19A,31B,32B,79B,102C 'use':70B,80B 'user':5A,59B,123C 'vulner':109C","nicknames":[],"mitigations":[],"who_affected":"Teams running sshportal 1.19.5 or earlier as an SSH bastion where some users have accounts but are not admins. Any user who can log in to the management interface can reach the flaw, and backend keys are exposed with it, so rotate those keys after patching. Deployments where every account is an admin are not exposed in the same way.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111638","severity":null,"published_at":"2026-10-16T18:17:44+00:00","modified_at":"2026-10-23T17:17:20+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111638:787","url":null,"severity":null,"published_at":"2026-10-25T03:45:51+00:00","modified_at":"2026-10-25T03:45:51+00:00","first_seen_at":"2026-10-25T03:45:51+00:00","fetched_at":"2026-10-25T03:45:51+00:00","note":"No fixed version exists: latest moul/sshportal release is v1.19.5 (the affected one), no upstream advisory or fix commit found. Reporter writeup (hackmd) is static code review, not run live; key show (shell.go:1513-1584) lacks the CheckRoles admin check that key inspect has. No exploitation or PoC reported."}],"documents":[{"id":3326,"url":"https://hackmd.io/@hieuPenguinnn/sshportal-key-show-privkey-disclosure","title":"sshportal: non-admin disclosure of backend host private SSH keys via key show (reporter writeup)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3327,"url":"https://www.vulncheck.com/advisories/sshportal-through-1.19.5-missing-authorization-in-key-show-command-exposes-private-keys","title":"VulnCheck advisory: sshportal through 1.19.5 key show","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3328,"url":"https://github.com/moul/sshportal/releases","title":"moul/sshportal releases (latest v1.19.5)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}