CVE-2026-82448

Critical

Description

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.

SeverityCritical

CVSS9.8

Exploit probability—

ProductShinobi

PublishedAug 29, 2026

First seenAug 29, 2026

Weakness typeCWE-798Hard-coded credentials

How to fix

Update

Shinobi Systems Shinobi5a76c74f3977661ff3f9fd55a260db352c0b19c0 or later

Patches

gitlab.com/Shinobi-Systems/Shinobi/-/commit/5a76c74f3977661ff3f9fd55a260db352c0b19c0

Affected products

Product	Affected versions	Fixed in
Shinobi Systems Shinobi	v < 5a76c74f3977661ff3f9fd55a260db352c0b19c0	5a76c74f3977661ff3f9fd55a260db352c0b19c0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.