Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-82448

Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

CVSS 4.0 9.3 CRITICALCVSS 3.1 9.8 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-82448

Published

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-82448

Published

Shinobi

https://gitlab.com/Shinobi-Systems/Shinobi

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Shinobi Systems",
                    "product": "Shinobi",
                    "collectionURL": "https://gitlab.com/Shinobi-Systems/Shinobi",
                    "repo": "https://gitlab.com/Shinobi-Systems/Shinobi",
                    "versions": [
                        {
                            "version": "0",
                            "lessThan": "5a76c74f3977661ff3f9fd55a260db352c0b19c0",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON