Key points
- The vulnerability affects sshportal versions 1.19.5 and earlier.
- It allows authenticated non-admin users to obtain decrypted backend private SSH keys.
- Attackers can bypass access control lists and session recording by using predictable key names.
Users of the sshportal application through version 1.19.5 face a high-severity authorization flaw. The issue resides in the management shell's 'key show' command. According to the National Vulnerability Database record for CVE-2026-111638, this weakness allows authenticated users without administrative privileges to retrieve sensitive credentials. The flaw is classified as CWE-862, indicating missing authorization for critical functions.
In plain English
The sshportal tool helps manage SSH access, but a specific command fails to check if a user has permission to view private keys. Any logged-in user who is not an administrator can type a command to display these keys. The system returns the decrypted private keys directly to the user. This breaks the intended security model of the application.
The background
The vulnerability carries a CVSS score of 8.3, which is rated as high severity. An attacker does not need to guess complex identifiers to exploit this. They can request keys with predictable names such as 'default' or 'host'. Once obtained, these private keys allow direct connections to backend servers. This method bypasses access control lists and avoids session recording features that would normally log the activity.
What changes now
No patch or update has been confirmed for this issue yet. Organizations using sshportal version 1.19.5 or earlier remain exposed. The risk involves the potential compromise of backend infrastructure through stolen credentials. Users must monitor vendor channels for a fix. Until then, the application's security controls regarding key access are ineffective for non-admin users.
Who needs to act first
Teams should prioritize auditing systems where non-admin users have access to the sshportal management interface. Check whether any backend hosts are accessible using default key names like 'host' or 'default'. If possible, restrict network access to the management shell to administrative workstations only. Rotate any private keys that may have been exposed during this window. Monitor logs for unusual 'key show' command usage by non-privileged accounts to detect potential abuse while awaiting a vendor update.
What to do and how to stay safe: sshportal
- Verify if your sshportal installation is version 1.19.5 or older.
- Restrict access to the management shell to trusted administrative networks.
- Monitor audit logs for non-admin users executing the 'key show' command.
- Prepare to rotate backend SSH private keys once a patch is available.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which sshportal versions are affected by CVE-2026-111638?
The vulnerability affects sshportal versions up to and including 1.19.5.
What can an attacker do with this flaw?
They can obtain decrypted backend private SSH keys and connect directly to hosts, bypassing ACLs and session recording.
Is there a patch available for this vulnerability?
No fix has been confirmed yet for this issue.
