Skip to content

shellhub

Server & OS Management

Centralized SSH gateway for remotely accessing and managing Linux servers and devices from anywhere

Track releases GitHub Website
TypeScript Latest v0.26.0 · 20d ago Security brief →

Features

  • Native SSH support via standard tools like OpenSSH Client or PuTTY
  • SCP/SFTP file transfer using industry‑standard utilities
  • Secure SSH port forwarding for remote service access
  • Public‑key authentication enabling multi‑user access without shared passwords
  • Configurable firewall rules to filter incoming SSH connections

Security Response History

1 CVE
CVE Severity Disclosed Patched (this tool) vs Ecosystem Median
CVE-2023-44487 KEV medium
CVSS 7.5
 2023-10-10 2026-01-02 2y 3mo / median 2y 3mo

Recent releases

View all 12 releases →
Review required
v0.26.0 Breaking risk
Auth RBAC

PostgreSQL migration + light theme + Server‑side Vault

Open
Review required
v0.25.1 Mixed
Dependencies

API uniqueness + UI auto‑lock

Open
Upgrade now
v0.25.0 Security relevant
Breaking upgrade Dependencies

Postgres-only datastore + MCP server

patches CVE-2023-44487
Open
v0.24.2 Breaking risk
Notable features
  • Add team invitations
  • Add Containers page and components
  • Implement announcements admin panel
Full changelog

What's Changed

  • chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.41.0 to 1.43.0 in /tests by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6146
  • feat(ui-react): implement announcements admin panel by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6133
  • feat(ui-react): add admin sessions list and detail pages by @luannmoreira in https://github.com/shellhub-io/shellhub/pull/6107
  • ci: remove private registry dependency from CI workflows by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6150
  • fix(infra): ensure postgres container restarts after host reboot by @geovannewashington in https://github.com/shellhub-io/shellhub/pull/6152
  • refactor(ui-react): unify main and admin sidebar behavior by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6151
  • chore(deps): bump axios from 1.13.6 to 1.15.0 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6157
  • ui: bump axios from 1.14.0 to 1.15.0 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6156
  • fix(cli): ensure first user created via CLI is admin by @geovannewashington in https://github.com/shellhub-io/shellhub/pull/6155
  • fix(gateway): raise WebSocket timeouts and enable TCP keepalive by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6158
  • chore(ci): remove verify-fix workflow by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6161
  • feat(agent): default transport to yamux (v2) by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6163
  • fix(ui-react): fix sidebar behavior when terminal is open by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6166
  • refactor(ui-react): add reusable DataTable component by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6164
  • refactor(api): remove RSA signature gate from initial setup flow by @geovannewashington in https://github.com/shellhub-io/shellhub/pull/6162
  • fix(ui-react): fix License page upload input on Chromium by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6189
  • docker: api: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6186
  • docker: cli: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /cli by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6185
  • docker: agent: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /agent by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6184
  • docker: ssh: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /ssh by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6183
  • docker: gateway: bump golang from 1.25.8-alpine3.22 to 1.25.9-alpine3.22 in /gateway by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6182
  • docker: ui: bump nginx from 1.29.7-alpine to 1.29.8-alpine in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6181
  • ui: bump typescript-eslint from 8.58.0 to 8.58.2 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6180
  • refactor(ui-react): split useCopy hook into its own file by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6167
  • chore: update gliderlabs/ssh fork to fix golang.org/x/crypto v0.50.0 compatibility by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6193
  • ui: bump eslint-plugin-jest from 29.15.1 to 29.15.2 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6171
  • ssh: bump golang.org/x/net from 0.52.0 to 0.53.0 in /ssh by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6170
  • api: bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6177
  • api: bump golang.org/x/crypto from 0.49.0 to 0.50.0 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6178
  • ui: bump follow-redirects from 1.15.11 to 1.16.0 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6192
  • agent: bump github.com/mattn/go-shellwords from 1.0.12 to 1.0.13 in /agent by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6172
  • api: bump github.com/testcontainers/testcontainers-go/modules/postgres from 0.41.0 to 0.42.0 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6179
  • api: bump github.com/getsentry/sentry-go from 0.44.1 to 0.45.1 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6175
  • chore(deps): bump actions/github-script from 8 to 9 by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6188
  • chore(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6187
  • fix(ui-react): clear query cache on logout to drop stale user data by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6194
  • fix(ui-react): surface swallowed errors in ConfirmDialog delete flows by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6168
  • chore(deps): migrate dependabot from ui to ui-react by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6198
  • feat(cli): add type column to namespace list output by @geovannewashington in https://github.com/shellhub-io/shellhub/pull/6197
  • docker: ui-react: bump node from 24.13.0-alpine3.22 to 24.15.0-alpine3.22 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6207
  • ui-react: bump @types/node from 25.5.0 to 25.6.0 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6209
  • ui-react: bump @hey-api/openapi-ts from 0.94.3 to 0.94.5 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6210
  • ui-react: bump typescript-eslint from 8.57.0 to 8.58.2 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6211
  • ui-react: bump vitest from 4.1.0 to 4.1.4 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6208
  • ssh: bump github.com/pires/go-proxyproto from 0.11.0 to 0.12.0 in /ssh by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6206
  • ui-react: bump @tiptap/markdown from 3.22.2 to 3.22.3 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6205
  • api: bump github.com/testcontainers/testcontainers-go/modules/mongodb from 0.41.0 to 0.42.0 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6204
  • docker: ssh: bump alpine from 3.23.3 to 3.23.4 in /ssh by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6203
  • docker: gateway: bump alpine from 3.23.3 to 3.23.4 in /gateway by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6200
  • docker: api: bump alpine from 3.23.3 to 3.23.4 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6202
  • docker: ui-react: bump nginx from 1.29.4-alpine to 1.29.8-alpine in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6201
  • docker: cli: bump alpine from 3.23.3 to 3.23.4 in /cli by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6199
  • chore(ui-react): remove deprecated baseUrl from ui-react's tsconfig.json by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6212
  • refactor(ui-react): use @ import alias by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6213
  • fix(openapi): align tag name pattern with backend validation by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6216
  • ui-react: bump postcss from 8.5.8 to 8.5.10 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6225
  • ui-react: bump axios from 1.15.0 to 1.15.1 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6224
  • ui-react: bump @tiptap/react from 3.22.2 to 3.22.4 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6221
  • ui-react: bump autoprefixer from 10.4.27 to 10.5.0 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6223
  • chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6220
  • api: bump github.com/labstack/gommon from 0.4.2 to 0.5.0 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6219
  • api: bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6217
  • fix(api): expose internal namespace lookup for SSH service by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6228
  • fix(api): let admin panel through RequiresTenant guard by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6229
  • feat(ui-react): add Containers page and components by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6214
  • feat(ui-react): add team invitations feature by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6191
  • ui-react: bump typescript-eslint from 8.58.2 to 8.59.0 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6222
  • fix(ui-react): fix lint error in ContainerTagsPopover test by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6231
  • api: bump github.com/moby/moby/api from 1.54.1 to 1.54.2 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6218
  • docs(api): remove status field from namespace member schema by @geovannewashington in https://github.com/shellhub-io/shellhub/pull/6230
  • feat(ui): add SAML SSO login and admin authentication settings by @luannmoreira in https://github.com/shellhub-io/shellhub/pull/6196
  • test: optimize healthchecks and force image rebuild by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6234
  • fix(ui-react): make sidebar pinned by default on larger screens by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6235
  • agent: bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 in /agent by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6238
  • chore(deps): bump go.opentelemetry.io/otel from 1.40.0 to 1.41.0 by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6237
  • chore(deps): bump postcss from 8.4.49 to 8.5.10 in /ui by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6239
  • fix(ui-react): fix sidebar height and content overflow in layouts by @luannmoreira in https://github.com/shellhub-io/shellhub/pull/6233
  • ui-react: bump vitest from 4.1.4 to 4.1.5 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6247
  • ui-react: bump @tiptap/extension-link from 3.22.2 to 3.22.4 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6245
  • ui-react: bump @tanstack/react-query-devtools from 5.91.3 to 5.100.5 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6246
  • ui-react: bump react-router-dom from 7.13.1 to 7.14.2 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6243
  • fix(ci): update claude-code-action to v1 by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6252
  • feat(ui-react): wire firewall-rules and web-endpoints into the console by @luizhf42 in https://github.com/shellhub-io/shellhub/pull/6253
  • fix(ui): restore sidebar pin and hover behavior by @luannmoreira in https://github.com/shellhub-io/shellhub/pull/6251
  • ui-react: bump @tiptap/markdown from 3.22.3 to 3.22.5 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6244
  • api: bump github.com/getsentry/sentry-go from 0.45.1 to 0.46.0 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6242
  • refactor(cli): replace bind() with explicit field assignment by @geovannewashington in https://github.com/shellhub-io/shellhub/pull/6254
  • ui-react: bump postcss from 8.5.10 to 8.5.12 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6257
  • ui-react: bump globals from 17.4.0 to 17.5.0 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6260
  • ui-react: bump eslint from 10.0.3 to 10.2.1 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6259
  • ui-react: bump zustand from 5.0.11 to 5.0.12 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6258
  • api: bump github.com/getsentry/sentry-go from 0.46.0 to 0.46.1 in /api by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6256
  • ui-react: bump @tanstack/react-query-devtools from 5.100.5 to 5.100.6 in /ui-react by @dependabot[bot] in https://github.com/shellhub-io/shellhub/pull/6255
  • chore: bump shellhub version to v0.24.2 by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6261
  • fix(ci): generate release notes from docker-publish draft by @gustavosbarreto in https://github.com/shellhub-io/shellhub/pull/6263

Full Changelog: https://github.com/shellhub-io/shellhub/compare/v0.24.1...v0.24.2

View release on GitHub
v0.21.7 Security relevant
Security fixes
  • GHSA-vwx9-7qcf-gg7f - cross-tenant IDOR on namespace endpoints
  • GHSA-j72x-xfwg-783f - cross-tenant device metadata disclosure
  • GHSA-9w9c-9w8m-w89q - cross-tenant SSH session data disclosure
Full changelog

Security

Fixes four cross-tenant and input-validation advisories:

  • GHSA-vwx9-7qcf-gg7f — cross-tenant IDOR on namespace endpoints reachable via API Key and JWT callers, allowing a caller to read, edit, delete or toggle session recording of a namespace they are not scoped to, and to enumerate namespaces across tenants on the list endpoint. (initially fixed in v0.21.6)
  • GHSA-j72x-xfwg-783f — GET /api/devices/:uid returned the full device object for any authenticated caller, allowing cross-tenant disclosure of device metadata (hostname, MAC, OS, public key, remote address, last-seen).
  • GHSA-9w9c-9w8m-w89q — GET /api/sessions/:uid returned the full session object for any authenticated caller, allowing cross-tenant disclosure of SSH session data (username, device UID, remote IP, authentication state, timestamps).
  • GHSA-47r2-v3x6-wff9 — filter and sort query parameters on the device list accepted attacker-controlled identifiers as BSON keys, enabling HTTP 500 crash-DoS and blind regex extraction via $regex values.

Full Changelog: https://github.com/shellhub-io/shellhub/compare/v0.21.6...v0.21.7

View release on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
2,044
Forks
185
Languages
TypeScript Go MDX
View on GitHub Homepage Documentation

Install & Platforms

Platforms
linux

Community & Support

Community

Similar tools

Nexterm
DietPi
MeshCentral
server
LinuxGSM

Beta — feedback welcome: [email protected]