by Kastro
Paper/Archive/CVE-2026-82448

CVE-2026-82448

Shinobi Systems Shinobi — Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.1.531 × 2010.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.

Affected

ProductAffectedFixed inSource
Shinobi< 5a76c74f3977661ff3f9fd55a260db352c0b19c05a76c74f3977661ff3f9fd55a260db352c0b19c0CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgitlab.com/Shinobi-Systems/Shinobi/-/merge_requests/554patchgitlab.com/Shinobi-Systems/Shinobi/-/commit/5a76c74f3977661ff3f9fd55a260db352c0b19c0refgitlab.com/Shinobi-Systems/Shinobiwriteupgitlab.com/Shinobi-Systems/Shinobi/-/blob/f04e685b8bd4c6190fcd62993131b86a76c2b806/libs/childNode/utils.jswriteupvulncheck.com/advisories/shinobi-before-commit-5a76c74f-arbitrary-database-query-execution-via-hardcoded-child-node-key