sshportal up to version 1.19.5 contains a missing authorization flaw in the management shell’s ‘key show’ command. An authenticated user who does not hold admin rights can request key names such as ‘default’ or ‘host’, causing the server to return decrypted private SSH keys for the backend hosts. Those keys provide full SSH access, enabling the attacker to connect directly to the backend servers while evading ACL controls and session recording mechanisms.

The vulnerability affects the moul sshportal product, specifically versions up to and including 1.19.5.

The CVSS score of 8.3 indicates a high severity. The EPSS score is unavailable, but the lack of a KEV listing does not reduce the risk; attackers only need valid credentials to the management shell and can exploit the flaw to gain backend access. This bypasses essential security controls, representing a significant threat to confidentiality and integrity of the backend infrastructure.