---
id: "CVE-2026-111638"
kind: "vulnerability"
aliases: ["CVE-2026-111638"]
title: "sshportal: non-admin users can read decrypted backend SSH private keys"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "sshportal", "fixed": [], "affected": "<= 1.19.5", "ecosystem": "go"}]
ecosystems: []
tags: ["authz", "credential-disclosure", "other", "self-hosted", "ssh-bastion", "sshportal"]
not_affected_if: ["admin-only-accounts", "no-management-shell-access", "no-non-admin-users", "single-admin-only"]
published_at: "2026-10-16T18:17:44+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:45:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111638", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:45:51+00:00"}]
---

# sshportal: non-admin users can read decrypted backend SSH private keys

sshportal through 1.19.5 (every release): the management shell 'key show' command has no admin role check and prints the decrypted private key. Any authenticated non-admin user can run 'key show default' or 'key show host' (or use numeric IDs) and read the SSH client keys sshportal uses for backend hosts. They can then log in to those hosts directly, bypassing ACLs and session recording. No fix is published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:sshportal affected <= 1.19.5 fixed ?

## How to check

1) Run sshportal --version, or check the image tag; <= 1.19.5 is affected, and that is every release. 2) As a non-admin user run: ssh -p 2222 <your-username>@bastion 'key show default'. If a 'Private Key' line is printed, you are exposed. 3) Check shell logs for key show calls by non-admin users.

## Fix

No patched release as of 2026-10-25 (latest v1.19.5 is affected). Rotate the 'default' and 'host' SSH client keys and any other sshportal-managed key, re-authorize the new public keys on backend hosts, and restrict who has accounts. Upstream fix: unknown; a CheckRoles admin guard on key show would settle it.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111638
- 2026-10-25T03:45:51+00:00 analyst — No fixed version exists: latest moul/sshportal release is v1.19.5 (the affected one), no upstream advisory or fix commit found. Reporter writeup (hackmd) is static code review, not run live; key show (shell.go:1513-1584) lacks the CheckRoles admin check that key inspect has. No exploitation or PoC reported.

## Documents

- [advisory] sshportal: non-admin disclosure of backend host private SSH keys via key show (reporter writeup) https://hackmd.io/@hieuPenguinnn/sshportal-key-show-privkey-disclosure
- [advisory] VulnCheck advisory: sshportal through 1.19.5 key show https://www.vulncheck.com/advisories/sshportal-through-1.19.5-missing-authorization-in-key-show-command-exposes-private-keys
- [mentions] moul/sshportal releases (latest v1.19.5) https://github.com/moul/sshportal/releases

## From the sources

sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_