---
id: CVE-2026-82448
title: >-
  Shinobi before commit 5a76c74f contains a hardcoded connection key in the
  child node service that allows unauthenticated attackers to execute arbitrary
  database queries
summary: >-
  Shinobi before commit 5a76c74f contains a hardcoded connection key in the
  child node service that allows unauthenticated attackers to execute arbitrary
  database queries. Attackers reaching the child node port can present the
  hardcoded ke…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-798
published: '2026-08-29'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:43.827'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82448'
references:
  - url: 'https://gitlab.com/Shinobi-Systems/Shinobi'
    label: disclosure@vulncheck.com
  - url: >-
      https://gitlab.com/Shinobi-Systems/Shinobi/-/blob/f04e685b8bd4c6190fcd62993131b86a76c2b806/libs/childNode/utils.js
    label: disclosure@vulncheck.com
  - url: >-
      https://gitlab.com/Shinobi-Systems/Shinobi/-/commit/5a76c74f3977661ff3f9fd55a260db352c0b19c0
    label: disclosure@vulncheck.com
  - url: 'https://gitlab.com/Shinobi-Systems/Shinobi/-/merge_requests/554'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/shinobi-before-commit-5a76c74f-arbitrary-database-query-execution-via-hardcoded-child-node-key
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00697
epssPercentile: 0.51016
ingestedAt: '2026-08-30T07:49:08.381Z'
vendor: Shinobi Systems
product: Shinobi
affected:
  - Shinobi < 5a76c74f3977661ff3f9fd55a260db352c0b19c0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-31T18:36:08.178430Z'
---

## Overview

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.