sshportal: Missing authorization in 'key show' command exposes private SSH keys
Summary
sshportal, an SSH bastion server, through version 1.19.5 does not check the admin role in the management shell command 'key show'. Any authenticated user, including a non-admin user, can display the decrypted private SSH keys that sshportal uses to connect to backend hosts. With such a key, an attacker can connect directly to backend hosts, bypassing ACLs and session recording.
Affected
- sshportal through 1.19.5 (CNA record: 0 to <= 1.19.5)
- Default branch: affected according to the public write-up, not verified against the vendor source
Fixed in
- Unknown. No vendor advisory found.
- VulDB recommends upgrading to 1.19.6 or later; this version could not be confirmed.
Workaround
- Remove unneeded non-admin user accounts and review who can log in to the management shell.
- Restrict network access to the management interface to trusted IP addresses (third-party advice, not a vendor fix).
- Limit administrative rights to highly privileged staff.
Exploitation
- CISA SSVC (per CNA record): exploitation status 'poc', not automatable, partial technical impact.
- Not marked as known exploited (KEV: No) in the sources checked.
- A public write-up exists; no public proof of concept was confirmed.
Our recommendation
- Identify every sshportal instance and record its exact version.
- Remove or restrict non-admin accounts and limit access to the management interface.
- Monitor the upstream repository for a fixed release and verify any version before upgrading.
- Rotate and review the backend SSH keys that sshportal could reach, and check their authorized_keys files and access logs.
- Review the audit trail for unexpected 'key show' use, noting that it is unknown whether such calls are logged.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record details (VulnCheck advisory) www.vulncheck.com
- Vulnerable code in shell.go (v1.19.5) github.com
- Technical write-up (HackMD) hackmd.io
- VulDB entry CVE-2026-111638 vuldb.com
- Strix CVE summary www.strix.ai
- OpenCVE sshportal app.opencve.io
- sshportal releases github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:38.
Original description (NVD)
sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording.
NVD references (4)
- https://github.com/moul/sshportal/blob/v1.19.5/pkg/bastion/shell.go#L1513-L1584
- https://hackmd.io/@hieuPenguinnn/sshportal-key-show-privkey-disclosure
- https://www.vulncheck.com/advisories/sshportal-through-1.19.5-missing-authorization-in-key-show-command-expos…
- https://hackmd.io/@hieuPenguinnn/sshportal-key-show-privkey-disclosure
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.