sshportal AuthZ Bug in Mgmt Shell Lets Non-Admins Grab Decrypted SSH Keys
Authenticated non-admin users can retrieve decrypted backend SSH keys via the management shell, enabling direct access to infrastructure and bypassing security controls.
Key points
- sshportal versions up to 1.19.5 contain a missing authorization vulnerability in the management shell.
- The flaw allows authenticated non-admin users to obtain decrypted backend private SSH keys.
- Attackers can use predictable key names like 'default' or 'host' to retrieve credentials.
sshportal through version 1.19.5 contains a missing authorization vulnerability that allows authenticated non-admin users to access sensitive backend credentials. The flaw resides in the management shell's 'key show' command, which fails to verify if the requesting user has administrative privileges. This exposure enables attackers to retrieve decrypted private SSH keys, granting them direct access to backend hosts.
The risk
The vulnerability, tracked as CVE-2026-111638, carries a CVSS score of 8.3, classifying it as high severity. According to the NVD record, the weakness aligns with CWE-862, indicating improper verification of user authority. An attacker does not need to exploit complex injection flaws; they simply need an authenticated account with non-admin rights. Once logged in, they can execute the 'key show' command to extract private keys.
This access bypasses standard access control lists and session recording mechanisms. By obtaining the private keys, an attacker can connect directly to backend infrastructure. This lateral movement capability undermines the primary purpose of the jump host or bastion server, which is to centralize and monitor access. The breach of trust occurs at the application logic level, not the network perimeter.
Who is exposed
Environments running sshportal version 1.19.5 or earlier are exposed to this threat. The vendor, identified as moul in the source material, is associated with the affected software. Any organization using this tool for SSH bastion services or jump host management faces immediate risk. Teams that grant non-admin users access to the management interface for viewing sessions or logs are particularly vulnerable.
Cost and compliance
The source material does not provide specific financial costs or regulatory compliance impacts associated with this vulnerability. However, the ability to bypass session recording and access control lists may violate internal security policies and external compliance frameworks that require audit trails for infrastructure access. Organizations must assess their own risk tolerance regarding unauthorized access to backend systems and potential data exfiltration via stolen credentials.
What to watch
Security teams should monitor for any usage of the 'key show' command by non-administrative accounts. Review access logs for successful executions of this command by users who do not hold administrative privileges. Investigate any unexpected connections to backend hosts originating from the sshportal server, especially if they originate from user accounts that typically only view session data.
Signals worth monitoring
Teams usually detect this activity by reviewing application logs for the 'key show' command executed by low-privilege users. Check whether non-admin accounts are triggering credential retrieval actions outside of normal operational hours. Monitor for new SSH sessions initiated from the bastion host to backend servers, particularly if these sessions bypass standard recording protocols. Look for patterns where a user views a session and immediately requests key data.
What to do and how to stay safe: sshportal
- Audit sshportal user permissions to ensure only administrators have access to the management shell.
- Monitor application logs for the 'key show' command executed by non-admin accounts.
- Rotate backend SSH keys immediately if unauthorized access is suspected or confirmed.
- Implement network segmentation to limit direct access from the bastion host to sensitive backend systems.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of sshportal are affected by CVE-2026-111638?
sshportal versions up to and including 1.19.5 are affected by this missing authorization vulnerability.
What can an attacker do with this vulnerability?
An authenticated non-admin user can obtain decrypted backend private SSH keys and connect directly to backend hosts.
Is there a patch available for this flaw?
No fix has been confirmed yet in the provided source material for sshportal versions up to 1.19.5.
