Cyber & AI intelligence
Wasteland.
Briefs indexed2320
Issues25
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-82448 2026-08-29

CVE-2026-82448: Hardcoded Child Node Key Exposes Shinobi Databases to Unauthenticated SQL Execution

"A hardcoded connection key in Shinobi's child node service lets unauthenticated network attackers run arbitrary SQL queries against the video surveillance platform's database, earning a CVSS 3.1 score of 9.8 (CRITICAL)."

A hardcoded connection key in Shinobi's child node service lets unauthenticated network attackers run arbitrary SQL queries against the video surveillance platform's database, earning a CVSS 3.1 score of 9.8 (CRITICAL).

What Is It

Shinobi, an open-source video management platform maintained by Shinobi Systems, ships a hardcoded connection key in its child node service (CWE-798: Use of Hard-coded Credentials). An attacker who can reach the child node port presents that static key during the WebSocket handshake, which is enough to pass authentication. From there, the attacker dispatches SQL queries through the onWebSocketDataFromChildNode handler and executes them directly against the backing database.

Why It Matters

The attack needs no credentials, no user interaction, and no elevated privileges; just network reachability to the child node port. The CNA (VulnCheck) rates it 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with a CVSS 4.0 secondary score of 9.3. NVD has not published its own analysis of this record, so these are CNA-supplied scores and are subject to change. Because the key is baked into the source, it is identical across every unpatched deployment; there is no per-install secret to guess.

Impact is read and write: the advisory specifically calls out reading and modifying user records and camera configuration. That means credential theft, account tampering, and reconfiguration of the camera fleet the platform is meant to protect.

The CISA Known Exploited Vulnerabilities catalog contains no entry for this CVE, so there is no confirmed active exploitation or federal remediation deadline at this time.

What's Vulnerable

Versioning here is git-commit based rather than release-tagged, so operators should identify their deployed commit rather than relying on a version number.

Patch Status

Fixed in upstream commit 5a76c74f (GitLab merge request !554). Operators running Shinobi from source should update to a commit at or after 5a76c74f3977661ff3f9fd55a260db352c0b19c0. No vendor-assigned remediation deadline or CISA required action exists for this CVE. The record was published 2026-08-29 and remains in NVD status "Received," meaning NVD enrichment is still pending and the published details may change.

Sources