CVE-2026-82448

CriticalCVSS 9.8/10Last modified Sep 23, 2026

Description

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

VendorProductVersions
Shinobi SystemsShinobi< 5a76c74f3977661ff3f9fd55a260db352c0b19c0

References

Timeline

Published
Aug 29, 2026
Last modified
Sep 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-824495.3Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password vCVE-2026-82455.4Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. Concrete\Core\Legacy\PaginatiCVE-2026-824508.8BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with ImpoCVE-2026-824516.1Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescapedCVE-2026-824529.8rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guaCVE-2026-824537.5rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API respoCVE-2026-824549.1The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The CVE-2026-8245610.0argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCVE-2026-824577.8su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing trCVE-2026-824588.7Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd,CVE-2026-824598.2Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affectCVE-2026-824609.8Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to prop
CVE-2026-82448: Critical severity, CVSS 9.8 | Vulnix