CVE-2026-53546
CriticalCVSS 9.6Summary
Termix before version 2.3.2 contains a vulnerability in the terminal WebSocket that allows an authenticated low-privileged user to use another user's credentials to connect to an attacker-controlled SSH server. This can lead to disclosure of SSH passwords or private keys.
Risk Assessment
Disclosure of SSH credentials could allow an attacker to access systems managed by Termix, compromising the security of the entire infrastructure.
Recommendation
Upgrade Termix to version 2.3.2 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When no credential is shared with the requester, resolveHostById performs an owner credential fallback, and src/backend/ssh/terminal.ts combines that credential with attacker-controlled ip, port, and username values. An authenticated low-privileged user can therefore make Termix authenticate to an attacker-controlled SSH server and disclose another user's stored SSH password or private-key material while the victim user's data key is unlocked. This issue is fixed in version 2.3.2.