CVE-2026-45745: Termix Information Disclosure Flaw

CVE-2026-45745 Overview

CVE-2026-45745 affects Termix, a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, the Termix Desktop client built on Electron disables TLS certificate validation when connecting to the configured Termix server. This defect allows a machine-in-the-middle (MITM) attacker positioned on the network to intercept and modify HTTPS traffic. Attackers can capture credentials and steal JSON Web Tokens (JWTs) or session tokens during login and routine operations. The flaw is tracked under CWE-295: Improper Certificate Validation. At the time of publication, no patched version is available.

Critical Impact
An attacker with network position can intercept Termix Desktop traffic, harvest credentials, and hijack authenticated sessions through stolen JWTs.

Affected Products

Termix Desktop (Electron) version 1.7.0 and later
Termix server deployments accessed by vulnerable desktop clients
All operating systems running the affected Electron client builds

Discovery Timeline

2026-06-05 - CVE-2026-45745 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-45745

Vulnerability Analysis

The Termix Desktop application is built on the Electron framework, which wraps a Chromium renderer and a Node.js backend. The desktop client communicates with the Termix server over HTTPS to authenticate users and proxy SSH sessions. Starting in version 1.7.0, the client configuration disables TLS certificate validation for outbound HTTPS requests. As a result, the client accepts any certificate presented by a server, including self-signed or attacker-controlled certificates. An attacker positioned between the client and server can present a forged certificate and decrypt the session.

Exploitation requires the attacker to occupy a network path between the desktop client and the Termix server. Successful interception exposes login credentials submitted by the user and JWT or session tokens issued by the server. With these tokens, the attacker can impersonate the user and access managed SSH endpoints through the Termix platform.

Root Cause

The root cause is improper certificate validation [CWE-295] in the Electron client. The application either sets rejectUnauthorized to false on its HTTPS agent or overrides the certificate verification callback to unconditionally trust the peer. Either configuration eliminates the protection provided by the TLS public key infrastructure.

Attack Vector

The attack vector is network-based and requires user interaction in the form of a normal login or use session. An adversary on the same Wi-Fi network, on a compromised upstream router, or in control of a malicious proxy can perform ARP spoofing, DNS poisoning, or BGP hijacking to redirect Termix Desktop traffic. The attacker then terminates TLS with a forged certificate. Because the client skips validation, no warning is shown to the user. Captured material includes plaintext credentials, JWTs, and any data exchanged during the session.

No verified proof-of-concept code is publicly available. See the GitHub Security Advisory GHSA-r9gw-3w87-mhh7 for advisory details.

Detection Methods for CVE-2026-45745

Indicators of Compromise

Unexpected TLS certificates presented for the Termix server hostname, particularly self-signed or issued by unfamiliar certificate authorities
Termix Desktop connections originating from or traversing unexpected proxy hosts or ARP-anomalous network segments
JWT or session reuse from multiple geographic IP addresses for a single Termix account
Repeated SSH session establishment from the Termix server backend at unusual times following a user login

Detection Strategies

Pin or monitor the expected server certificate fingerprint at the network perimeter and alert on deviations
Inspect Termix server access logs for the same JWT used from multiple source IPs within a short window
Correlate desktop client logins with subsequent SSH actions to identify session activity that does not match the originating user behavior
Use endpoint telemetry to identify the Termix Desktop binary version 1.7.0 and later across the fleet

Monitoring Recommendations

Monitor outbound TLS connections from hosts running Termix Desktop and flag certificate chain anomalies
Enable authentication and session auditing on the Termix server and forward logs to a centralized SIEM
Watch for ARP table changes, gateway MAC flips, and DHCP anomalies on networks where Termix Desktop is used

How to Mitigate CVE-2026-45745

Immediate Actions Required

Stop using Termix Desktop versions 1.7.0 and later until a fixed release is published; revert to the web client over a trusted HTTPS path where feasible
Rotate all credentials and revoke active JWTs or sessions for any account that has used the affected desktop client
Restrict Termix server access to trusted networks or require a VPN to reduce the attacker's ability to reach a MITM position
Subscribe to the Termix GitHub advisory feed for patch notifications

Patch Information

As of the publication date, no patched version of Termix Desktop is available. Track the upstream GHSA-r9gw-3w87-mhh7 advisory for fix availability and upgrade as soon as a corrected release ships.

Workarounds

Access the Termix server through the browser-based interface, which performs standard TLS validation
Tunnel desktop client traffic through a trusted VPN to a network segment where MITM is not feasible
Deploy certificate transparency monitoring for the Termix server domain to detect rogue certificate issuance
Shorten JWT lifetime and enforce IP binding on the Termix server to limit the value of stolen tokens

bash

# Example: enforce VPN-only access to the Termix server with iptables
iptables -A INPUT -p tcp --dport 443 -s 10.8.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP