CVE-2026-111638 moul CVE debrief

Who should care

System administrators and security teams responsible for sshportal installations should assess exposure and verify inventory to prevent unauthorized access to private keys. This includes reviewing user access controls, ensuring private keys are properly secured and rotated, and implementing compensating controls such as monitoring for suspicious activity. Affected operator, platform, vulnerability-management, and security-team impact should be evaluated to

Why it matters

CVE-2026-111638 allows authenticated non-admin users to obtain decrypted backend private SSH keys, potentially leading to unauthorized access to backend hosts. System administrators and security teams should assess exposure and verify inventory to prevent this vulnerability.

• Authenticated non-admin users can obtain decrypted backend private SSH keys
• Private keys can be exposed, allowing unauthorized access to backend hosts
• ACLs and session recording can be bypassed
• Verification of inventory and user access controls is necessary

Technical summary

The sshportal management shell 'key show' command allows authenticated non-admin users to obtain decrypted backend private SSH keys due to missing authorization. Attackers can request predictable key names to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording. This vulnerability affects sshportal through 1.19.5 and can be mitigated by restricting access to the 'key show' command and verifying private key security. System administrators should assess exposure and verify inventory to prevent unauthorized access.

Defensive priority

Authenticated non-admin users can obtain decrypted backend private SSH keys; assess exposure and verify inventory.

Recommended defensive actions

• Assess exposure by verifying inventory of sshportal installations and user access controls
• Verify that private keys are properly secured and rotated
• Restrict access to the 'key show' command to admin users only
• Consider compensating controls such as monitoring for suspicious activity
• Review vendor patch guidance for sshportal
• Perform exposure review for affected systems
• Implement monitoring for potential exploitation attempts

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Supplemental sources include a technical description and third-party advisories. The vulnerability has been confirmed in sshportal through 1.19.5. Defenders should verify inventory of sshportal installations, user access controls, and private key security. Evidence limits suggest that the vulnerability allows authenticated non-admin users to obtain decrypted backend private SSH keys, potentially leading to unauthorized access to and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.