EXPOSURES › CVE-2026-82448
CVE-2026-82448
CRITICALShinobi's hardcoded connection key in the child node service allows unauthenticated attackers to execute arbitrary SQL queries and modify user records and camera configuration.
A hardcoded connection key in Shinobi's child node service lets unauthenticated attackers execute arbitrary SQL queries via the WebSocket handshake, enabling them to read and modify user records and camera configuration. DIB organizations must ensure no hardcoded credentials exist in their software supply chain, as this directly violates secure coding practices and exposes sensitive data to manipulation. Immediate remediation requires patching the vulnerability and auditing all software for similar hardcoded secrets.
Shame score — Hardcoded credentials are a fundamental security failure that is entirely avoidable and directly enables unauthenticated attackers to manipulate data and configuration.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.