CVE case study
CVE-2026-78878: Default Superuser Credential in Shinobi Enables Remote Code Execution
Shinobi ships a working default Superuser credential in super.sample.json that the installers copy to the live super.json without forcing a change, so a remote attacker who logs in to the default-enabled /super panel with the publicly known credential can download and install an attacker-controlled module and gain remote code execution. The vendor confirmed the issue and fixed it in commit 010e6285.
- Weakness
- CWE-1392, CWE-798, CWE-94
- Affected
- Shinobi versions up to and including 2.0.0 (source commit 9ddc2c3c, official Docker image shinobisystems/shinobi:latest)
- Remediation state
- Fixed in commit 010e6285 on the vendor's Fix-#562 branch
- Advisory published
- 4 Sep 2026
Official vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Why it matters
Shinobi is an open-source video management and CCTV recording platform. It exposes a Superuser panel at /super for administrative tasks, including a custom auto-load module feature that can fetch and install add-on modules. The root cause is that Shinobi ships a working Superuser login inside super.sample.json, and the installers copy that sample into the live super.json without forcing the operator to change it. The credential, admin@shinobi.video with the md5 hash of the word admin, is the same on every install and is publicly known, and the /super panel is enabled by default.
Because the credential is shipped rather than generated per installation, any remote attacker who can reach the panel can authenticate without knowing anything specific about the target. Once logged in, the attacker uses the module feature to download a module from a URL they control (POST /super/{key}/package/download) and then install it (POST /super/{key}/package/install). The install step runs the downloaded module's INSTALL.sh through spawn of a shell, or its npm install lifecycle scripts, so the attacker crosses from an unauthenticated network position to code execution on the host. The submitted vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scores it 9.8 out of 10, in the Critical band.
The finder reported the issue through a confidential GitLab issue, and the vendor confirmed it and fixed it in commit 010e6285 on the Fix-#562 branch, merging to dev and then master. The engineering lesson is that a sample configuration should never contain a usable credential: first-run setup should generate a unique secret or refuse to start until the operator sets one, so that shipping defaults can never become live production secrets.