Shinobi EUVD-2026-68097

Exploitation requires network reachability to the Shinobi child node service port and use of the hardcoded connection key embedded in libs/childNode/utils.js to pass the WebSocket handshake - no account, credential theft, or user interaction is needed (PR:N/UI:N). The key limiting factor is exposure of the child node port: the vulnerable handler (onWebSocketDataFromChildNode) is only reachable if that port is accessible to the attacker, so deployments that do not use distributed child nodes or that keep the port on a trusted internal segment are not remotely exploitable from untrusted networks. Instances running any commit before 5a76c74f are affected.

This is a genuinely high-priority issue rather than an inflated CVSS number. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation with high confidentiality and integrity impact, which is consistent with the described hardcoded-key bypass - no user interaction and no privileges required. Hardcoded credentials are trivially reproducible once the source (which is public on GitLab) is inspected, so the practical exploitation barrier is low even though no POC or KEV listing is present. The main real-world limiter is exposure: exploitation requires network reachability to the child node port, so deployments that keep that port on a trusted internal segment are far less exposed than those exposing it to untrusted networks. EPSS is not provided, and there is no evidence of active exploitation, so this should be treated as an urgent patch based on ease of exploitation and impact rather than on confirmed in-the-wild activity.

An attacker who can reach the Shinobi child node port opens a WebSocket connection and completes the handshake using the publicly-known hardcoded key extracted from the project source. They then send crafted messages to the onWebSocketDataFromChildNode handler to run SQL that dumps or alters user records (e.g., credentials/roles) and rewrites camera configuration. No public exploit is identified at time of analysis, but the low complexity and public source make weaponization straightforward.