CVE-2026-111638
sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys
CVSS Score
7.7
EPSS Score
0.0%
EPSS Percentile
0th
sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.
| CWE | CWE-862 |
| Vendor | moul |
| Product | sshportal |
| Published | Oct 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for moul sshportal
Be the first to know when new high vulnerabilities affecting moul sshportal are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
moul / sshportal
0 ≤ 1.19.5
References
hackmd.io: https://hackmd.io/@hieuPenguinnn/sshportal-key-show-privkey-disclosure github.com: https://github.com/moul/sshportal/blob/v1.19.5/pkg/bastion/shell.go#L1513-L1584 vulncheck.com: https://www.vulncheck.com/advisories/sshportal-through-1.19.5-missing-authorization-in-key-show-command-exposes-private-keys
Credits
hieuPenguinnn