CVE-2026-53548: Termix Information Disclosure Vulnerability

CVE-2026-53548 Overview

CVE-2026-53548 is a broken access control vulnerability in Termix, a web-based server management platform that provides SSH terminal, tunneling, and file editing capabilities. Versions prior to 2.6.1 expose an authorization flaw in the GET /host/db/host/:id/password endpoint. Any authenticated user with a valid JSON Web Token (JWT) can enumerate sequential host IDs and retrieve plaintext SSH or sudo passwords belonging to other users. The disclosed credentials enable access to managed systems outside the Termix instance. The issue is fixed in version 2.6.1 and is categorized under [CWE-285] Improper Authorization.

Critical Impact
Authenticated attackers can extract other users' plaintext SSH and sudo credentials by enumerating numeric host IDs, enabling lateral movement into managed infrastructure.

Affected Products

Termix versions prior to 2.6.1
The src/backend/database/routes/host.ts credential resolution route
Managed SSH hosts and sudo-enabled systems reachable through Termix

Discovery Timeline

2026-08-19 - CVE-2026-53548 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-53548

Vulnerability Analysis

The vulnerability resides in Termix's credential retrieval endpoint at GET /host/db/host/:id/password. The route accepts an authenticated user's numeric host ID together with a field=password or field=sudoPassword query parameter. It authenticates the request via JWT but fails to verify that the requesting user owns the host referenced by :id.

When the requester-scoped lookup fails to match a host, the code falls back to resolving the host using the owner's context. The endpoint then returns the owner's plaintext credential to the unauthorized caller. Because host IDs are sequential integers, an attacker iterates through IDs to harvest every stored SSH and sudo credential.

The returned credentials are plaintext, so no offline cracking is required. Attackers can immediately authenticate to the underlying managed systems, pivot into internal networks, and escalate privileges using retrieved sudo passwords.

Root Cause

The root cause is missing ownership enforcement during credential resolution [CWE-285]. The route validates authentication but not authorization. A failed requester-scoped query silently promotes to an owner-scoped query, breaking the tenant isolation model that the endpoint should enforce.

Attack Vector

Exploitation requires only a valid Termix account and network access to the application. The attacker sends authenticated HTTP GET requests to /host/db/host/{id}/password?field=password while incrementing the id value. Each successful response returns another user's plaintext SSH or sudo password.

// Fix reference: v2.3.2 patch commit 52f4e51a
// Source: https://github.com/Termix-SSH/Termix/commit/52f4e51ae03b5b8d2608e1383e2ccf79d290132b
// The upstream fix hardens ownership checks in src/backend/database/routes/host.ts
// and prevents fallback resolution to the host owner's context.

Detection Methods for CVE-2026-53548

Indicators of Compromise

Repeated authenticated GET /host/db/host/:id/password requests from a single user within a short window
Sequential enumeration patterns across numeric host :id values from one JWT subject
Requests including field=password or field=sudoPassword query parameters from accounts that historically do not access those hosts
SSH logins to managed servers originating from IP addresses not associated with the credential's legitimate owner

Detection Strategies

Parse Termix application logs for high-frequency access to the password endpoint and correlate JWT subject to host owner
Alert when a single user requests credentials for more than a small threshold of distinct host IDs in any 24-hour window
Cross-reference successful SSH authentications on managed hosts with the expected Termix user population

Monitoring Recommendations

Forward Termix reverse proxy and application logs to a centralized analytics platform for query and alerting
Monitor downstream SSH servers for authentication anomalies such as unusual source IPs, off-hours logins, and new user-agent strings
Track sudo command execution on managed systems for privilege escalation following credential exposure

How to Mitigate CVE-2026-53548

Immediate Actions Required

Upgrade Termix to version 2.6.1 or later without delay
Rotate every SSH password and sudo password stored in the affected Termix instance, assuming all credentials are compromised
Invalidate all active Termix JWTs and force re-authentication of every user
Review SSH authorized_keys, sudoers configuration, and recent shell history on managed hosts for signs of unauthorized access

Patch Information

The fix is available in Termix 2.6.1. See the GitHub Security Advisory GHSA-j6h8-mww6-pgw6, the remediation pull request #874, and the upstream commit 52f4e51a for implementation detail.

Workarounds

Restrict network access to the Termix instance to trusted administrators via VPN or IP allowlisting until the upgrade is complete
Temporarily disable non-administrative user accounts to reduce the pool of valid JWTs capable of exploitation
Move sensitive credentials out of Termix into a dedicated secrets manager with per-user access policies

bash

# Upgrade to the patched Termix release
docker pull ghcr.io/termix-ssh/termix:2.6.1
docker stop termix && docker rm termix
docker run -d --name termix ghcr.io/termix-ssh/termix:2.6.1

# Verify the running version
curl -s http://localhost:8080/version