Shelter: Improper authentication in exported activity allows auth_key registration
Summary
Shelter versionCode 445 (F-Droid version 1.9.1) exports an activity that accepts intents from any app without a permission. According to a third-party advisory, a local app with no permissions can register its own auth_key on a Shelter instance that was never enrolled and then use the app's binder service and change its preference state. Once a key is enrolled, the stored key is required, so the main risk is during first setup. The NVD score of 9.8 assumes network access, which the advisory does not confirm, so this should be treated as a risk from other apps on the same device.
Affected
- Shelter versionCode 445 (F-Droid version 1.9.1 (445))
- Other versions: Unknown.
Fixed in
Unknown. No fixed build has been confirmed.
Workaround
- Uninstall Shelter or remove its work profile if it is not needed.
- No vendor workaround is known.
Exploitation
- Exploited in the wild: Not known.
- Public proof of concept: The third-party advisory describes a tested proof of concept. No entries were found in public exploit databases as of 29 Oct 2026.
- CISA SSVC: Exploitation poc, automatable yes, technical impact total.
Our recommendation
- Check whether Shelter is installed on company or BYOD devices and which versionCode is present.
- Uninstall Shelter or remove the work profile where the app is not required.
- Keep Android devices on a current security patch level.
- Watch the Shelter repository and F-Droid listing for a fixed build and update as soon as one is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- F-Droid: Shelter f-droid.org
- FFG0d advisory CVE-2026-107058 github.com
- Shelter project repository github.com
- Vulners NVD mirror CVE-2026-107058 vulners.com
- Strix CVE-2026-107058 www.strix.ai
- OffSeq Radar CVE-2026-107058 radar.offseq.com
- PSIRT CVE-2026-107058 psirt.com
- The Hacker Wire CVE-2026-107058 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:47.
Original description (NVD)
An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.