CVE-2026-111638

EUVD-2026-103060
sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.7 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 22.83%
Common Weakness Enumeration
References
https://github.com/moul/sshportal/blob/v1.19.5/pkg/bastion/shell.go#L1513-L1584
https://hackmd.io/@hieuPenguinnn/sshportal-key-show-privkey-disclosure
https://www.vulncheck.com/advisories/sshportal-through-1.19.5-missing-authorization-in-key-show-command-exposes-private-keys