Sshportal
Monthly
Authenticated non-admin users of sshportal's management shell can retrieve decrypted backend SSH private keys through the 'key show' command, allowing them to connect directly to managed hosts and bypass ACLs and session recording. The flaw affects sshportal through version 1.19.5 and requires only a valid non-admin account with management shell access; default deployments are impacted because predictable key names such as 'default' and 'host' are commonly present. No public exploit code or confirmed active exploitation was identified at time of analysis, but the CVSS 4.0 score is 8.3 (High) and our assessment rates it as a medium-to-high priority for shared multi-user bastion deployments.
Authenticated non-admin users of sshportal's management shell can retrieve decrypted backend SSH private keys through the 'key show' command, allowing them to connect directly to managed hosts and bypass ACLs and session recording. The flaw affects sshportal through version 1.19.5 and requires only a valid non-admin account with management shell access; default deployments are impacted because predictable key names such as 'default' and 'host' are commonly present. No public exploit code or confirmed active exploitation was identified at time of analysis, but the CVSS 4.0 score is 8.3 (High) and our assessment rates it as a medium-to-high priority for shared multi-user bastion deployments.