sshportal CVE-2026-111638

Requires the attacker to hold a valid non-admin sshportal account with access to the management shell (PR:L), after which they invoke the 'key show' command against predictable, commonly-present key names such as 'default' or 'host'. No admin role and no user interaction are required, and default configurations are affected because these predictable key names exist by design. The limiting factors are: the attacker must already be an authenticated sshportal user, and the target must be running sshportal at or below version 1.19.5 as a shared multi-user bastion (a single-user or admin-only deployment has no untrusted principal to abuse).

This is a credible, medium-to-high priority issue for the specific population that runs sshportal, though its blast radius is limited by product footprint rather than exploit difficulty. The provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, score 8.3) indicates a network-reachable, low-complexity attack that requires low privileges (PR:L) and no user interaction, with high confidentiality impact on both the vulnerable system (VC:H) and a subsequent system (SC:H) - the subsequent-system impact correctly captures that stolen backend keys grant access to downstream hosts. The signals are internally consistent: CWE-862 (Missing Authorization) matches the description of an authenticated non-admin user reading data they should not. No EPSS score is provided, so exploitation-probability cannot be quantified. It is NOT in CISA KEV, so there is no confirmed active exploitation. No formal POC/exploit-code signal is flagged in the input, though a public technical writeup (hackmd) describes the exact method and the exact vulnerable source lines are public, which materially lowers the barrier to exploitation. The main reason this is not a top-tier emergency is prevalence, not technical severity: sshportal is a niche open-source bastion, so this is a serious flaw in a low-footprint product rather than a widespread internet-scale risk. Within any environment that does run sshportal with multiple non-admin users, however, it is a direct, high-value privilege/ACL escalation.

An authenticated non-admin sshportal user connects to the management shell and runs the 'key show' command with a predictable key name such as 'default' or 'host', which returns the decrypted backend private SSH key. The attacker then uses that key to connect directly to backend hosts, bypassing sshportal's ACLs and session recording entirely. A public technical writeup documents the method and the vulnerable source lines, and the low-complexity network vector (AV:N/AC:L) makes execution trivial once an account is held.