CVE-2026-82448

Shinobi, an open-source video surveillance/NVR platform, before commit 5a76c74f ships a hardcoded connection key in its child node service (CWE-798). An unauthenticated attacker who can reach the child node port can present this hardcoded key during the WebSocket handshake and then issue arbitrary SQL queries through the onWebSocketDataFromChildNode handler. This allows the attacker to read and modify database contents, including user records and camera configuration, without valid credentials. Deployments are affected when they run an affected Shinobi version and the child node service port is reachable, a scenario typical of multi-server master/child node setups. No public proof-of-concept or confirmed exploitation is known; EPSS estimates a 0.4% probability of exploitation within 30 days and the issue is not in CISA KEV.

What to do: Update Shinobi to a build at or after commit 5a76c74f, which replaces the hardcoded child node connection key. Until patched, restrict the child node port to trusted hosts via firewall rules or VPN access and avoid exposing it to the internet. After upgrading, review user records and camera configurations in the database for unauthorized changes.