CVE-2026-53546: Termix Information Disclosure Vulnerability

CVE-2026-53546 Overview

CVE-2026-53546 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in Termix, a web-based server management platform that provides SSH terminal, tunneling, and file editing capabilities. Versions prior to 2.3.2 accept a user-controlled hostConfig.id on the terminal WebSocket and resolve the host without enforcing ownership or explicit access checks. An authenticated low-privileged user can coerce Termix into authenticating to an attacker-controlled SSH server using another user's stored credentials. The issue is fixed in version 2.3.2.

Critical Impact
A low-privileged authenticated attacker can steal another user's stored SSH password or private-key material by redirecting Termix to an attacker-controlled SSH endpoint while the victim's data key is unlocked.

Affected Products

Termix versions prior to 2.3.2
Termix SSH backend component src/backend/ssh/host-resolver.ts
Termix SSH backend component src/backend/ssh/terminal.ts

Discovery Timeline

2026-08-19 - CVE-2026-53546 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-53546

Vulnerability Analysis

The flaw resides in the Termix terminal WebSocket handler, which accepts a hostConfig.id value provided by the client. The resolveHostById function in src/backend/ssh/host-resolver.ts looks up the referenced host without verifying that the requester owns or has been explicitly granted access to that host record. When no credential is shared with the requester, the resolver falls back to the owner's stored credential material.

In src/backend/ssh/terminal.ts, that owner credential is then combined with ip, port, and username values supplied by the attacker in the same request. Termix subsequently attempts an SSH authentication handshake against the attacker-supplied host using the victim's password or private key, allowing the attacker's rogue SSH server to capture the secret in cleartext. The attack succeeds only while the victim's data key is unlocked in Termix.

Root Cause

The root cause is a missing authorization check in the host resolution path combined with an owner-credential fallback. Termix treats a valid hostConfig.id as sufficient proof of access rather than validating that the authenticated caller owns the referenced host or holds an explicit sharing grant [CWE-639].

Attack Vector

Exploitation requires network access to the Termix instance and a low-privileged authenticated session. The attacker submits a terminal WebSocket request referencing another user's hostConfig.id while overriding ip, port, and username to point at an SSH honeypot they control. When Termix connects, the honeypot logs the transmitted credential.

See the GitHub Security Advisory GHSA-57gp-39c7-4g9r for the maintainer's technical write-up. No public proof-of-concept exploit code is available at this time.

Detection Methods for CVE-2026-53546

Indicators of Compromise

Outbound SSH connections from the Termix host to IP addresses or ports not present in any legitimate host configuration.
Termix backend logs showing terminal sessions where the resolved host owner differs from the authenticated user issuing the request.
SSH authentication attempts originating from Termix using usernames that do not match the requesting user's typical host inventory.

Detection Strategies

Correlate Termix application logs with egress network telemetry to identify SSH sessions targeting hosts outside the approved inventory.
Alert on any WebSocket request to the terminal endpoint where the supplied hostConfig.id belongs to a user other than the session principal.
Review database records for host configurations referencing external, low-reputation, or newly-observed destination IPs.

Monitoring Recommendations

Enable verbose audit logging on the Termix backend and forward events to a centralized SIEM for retention and correlation.
Monitor egress firewall logs for SSH traffic (TCP/22 and non-standard SSH ports) initiated by the Termix service account.
Track failed and successful SSH authentications on hosts referenced by Termix to detect anomalous credential reuse.

How to Mitigate CVE-2026-53546

Immediate Actions Required

Upgrade Termix to version 2.3.2 or later, which enforces ownership checks in resolveHostById and removes the owner-credential fallback path.
Rotate all SSH passwords and private keys stored in Termix that may have been accessible while vulnerable versions were in use.
Audit Termix user accounts and revoke low-privileged sessions that are not strictly required.

Patch Information

The fix is delivered in Termix release 2.3.2 via pull request #874 and commit 52f4e51. The patch enforces that the requester either owns or has an explicit sharing grant for the referenced hostConfig.id before credentials are resolved.

Source: GitHub Commit 52f4e51

text

 lerna-debug.log*
 
 node_modules
+src/mcp-server/node_modules
 dist
 dist-ssr
+coverage
 *.local
 
 .vscode/

Note: the diff snippet above reflects repository hygiene changes shipped alongside the security release; the substantive authorization fix is applied in the SSH backend modules referenced in the advisory.

Workarounds

Restrict Termix access to trusted, authenticated administrators only until the upgrade to 2.3.2 is complete.
Egress-filter the Termix host to allow SSH connections exclusively to a pre-approved list of internal destinations.
Require users to lock their data key when not actively using the terminal to shorten the window in which stored credentials can be exfiltrated.

bash

# Upgrade Termix via the official release channel
git fetch --tags
git checkout release-2.3.2-tag
# Or, when using Docker
docker pull ghcr.io/termix-ssh/termix:2.3.2
docker compose up -d