Vulnerability · Published Aug 29, 2026 · Assigned by VulnCheck

CVE-2026-82448Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

Critical 9.8

In plain English

A critical-severity hard-coded credentials in Shinobi from Shinobi Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.7%top 46.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.

Affected products (as reported)

Vendor	Product	Versions
Shinobi Systems	Shinobi	0 – before 5a76c74f3977661ff3f9fd55a260db352c0b19c0

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Merge request !554 issue-tracking
Fix commit patch
https://gitlab.com/Shinobi-Systems/Shinobi product
Vulnerable code: childNode/utils.js (the sql dispatch case) technical-description
VulnCheck Advisory: Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key third-party-advisory