CVE-2026-82448: Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

Q: Which deployments are exposed to unauthenticated exploitation?

Deployments where an attacker can reach the Shinobi child node port are exposed. No valid user credentials are required because the attacker can use the hardcoded child-node connection key during the WebSocket handshake.

Q: What access does exploitation provide?

An attacker can dispatch arbitrary database queries through the child-node WebSocket data handler. This permits reading and modifying user records and camera configuration.

Q: What is the remediation boundary?

The issue affects Shinobi versions before commit 5a76c74f. Updating to code that includes that commit removes the identified hardcoded-key condition.

Published Aug 29, 2026

Updated

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.

Affected Software

1 affected component

Shinobi Shinobi<5a76c74f

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Shinobi to a version that resolves this vulnerability.
Fixed in commit 5a76c74fPatch Arbitrary Database Query Execution via Hardcoded Child Node Key
Compensating control
Restrict network access to the Shinobi child node port so unauthenticated attackers cannot reach it and present the hardcoded key during the WebSocket handshake.

Event History

Aug 29, 2026

CVE Published

via MITRE·12:05 PM

Data Sourced

via MITRE·12:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

Deployments where an attacker can reach the Shinobi child node port are exposed. No valid user credentials are required because the attacker can use the hardcoded child-node connection key during the WebSocket handshake.

What access does exploitation provide?

An attacker can dispatch arbitrary database queries through the child-node WebSocket data handler. This permits reading and modifying user records and camera configuration.

What is the remediation boundary?

The issue affects Shinobi versions before commit 5a76c74f. Updating to code that includes that commit removes the identified hardcoded-key condition.

CVE-2026-82448: Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

What access does exploitation provide?

What is the remediation boundary?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to unauthenticated exploitation?

What access does exploitation provide?

What is the remediation boundary?