CRITICAL 9.3 NVD
CVE-2026-82448
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.
References
- https://gitlab.com/Shinobi-Systems/Shinobi
- https://gitlab.com/Shinobi-Systems/Shinobi/-/blob/f04e685b8bd4c6190fcd62993131b86a76c2b806
- https://gitlab.com/Shinobi-Systems/Shinobi/-/commit/5a76c74f3977661ff3f9fd55a260db352c0b19
- https://gitlab.com/Shinobi-Systems/Shinobi/-/merge_requests/554
- https://www.vulncheck.com/advisories/shinobi-before-commit-5a76c74f-arbitrary-database-que
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-08-29 via NVD.
Risk Timeline
CVE Disclosed2026-08-29 · -1 days ago
Remediation Resources
Analysis & PoC
gitlab.com/Shinobi-Systems/Shinobi
vulnfeed aggregates 11485 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.