CVE-2026-53549: Termix Information Disclosure Vulnerability

CVE-2026-53549 Overview

CVE-2026-53549 is a Server-Side Request Forgery (SSRF) vulnerability in Termix, a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. The POST /host/db/proxy/test endpoint accepts singleProxy, proxyChain, and testTarget request fields without validating destination addresses. An authenticated attacker can abuse the testProxyConnectivity path to open raw TCP and SOCKS connections to arbitrary hosts and ports reachable from the Termix server. The flaw affects all versions prior to 2.3.2 and is tracked under CWE-918.

Critical Impact
Authenticated users can probe internal networks and reach cloud metadata endpoints, potentially exposing cloud provider credentials and enabling lateral movement into private infrastructure.

Affected Products

Termix versions prior to 2.3.2
Termix POST /host/db/proxy/test endpoint
Termix testProxyConnectivity handler

Discovery Timeline

2026-08-19 - CVE-2026-53549 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-53549

Vulnerability Analysis

The Termix proxy connectivity test endpoint was designed to validate outbound proxy configurations before use. The implementation accepts user-controlled destination values through the singleProxy, proxyChain, and testTarget fields in the request body. The handler forwards these values directly to raw TCP and SOCKS connection routines without applying an allowlist or blocklist. This design allows any authenticated user to weaponize the server as a network probe.

Structured error responses returned by the endpoint disclose reachability status and connection timing. Attackers can infer which internal hosts and ports are alive by comparing response patterns. When the target is a cloud instance metadata service, a successful connection can return short-lived credentials, IAM role tokens, or user-data secrets tied to the underlying compute instance.

Root Cause

The root cause is missing destination validation in the testProxyConnectivity code path. The endpoint trusts client-supplied host and port values and performs no filtering against loopback ranges, RFC 1918 private address space, link-local ranges such as 169.254.169.254, or other sensitive internal destinations before initiating a socket connection.

Attack Vector

Exploitation requires an authenticated session on the Termix server. The attacker sends a crafted POST /host/db/proxy/test request specifying an internal or metadata endpoint as the target. The server dials the requested host and returns error or timing details that reveal service presence. On cloud-hosted Termix deployments, an attacker can pivot to the instance metadata service to retrieve provider credentials.

The fix in version 2.3.2 was delivered through pull request #874 and merged in commit 52f4e51. Refer to the Termix Security Advisory GHSA-x9pr-795g-rm5f for the vendor description.

Detection Methods for CVE-2026-53549

Indicators of Compromise

Requests to POST /host/db/proxy/test containing testTarget, singleProxy, or proxyChain values pointing at 127.0.0.1, localhost, RFC 1918 ranges, or 169.254.169.254.
Outbound TCP connections from the Termix host process to cloud metadata IPs such as 169.254.169.254 or fd00:ec2::254.
High-frequency proxy test requests from a single authenticated session enumerating sequential ports or hosts.

Detection Strategies

Log and inspect all HTTP requests targeting the /host/db/proxy/test route and flag payloads containing private, loopback, or link-local destinations.
Correlate Termix application logs with host-level network telemetry to identify unexpected connections initiated by the Termix process.
Alert on any egress from application servers to instance metadata service addresses, which should never originate from proxy test workflows.

Monitoring Recommendations

Deploy egress filtering rules and monitor for blocked attempts against metadata endpoints from the Termix workload.
Enable authentication and session audit logging to attribute proxy test requests to specific user accounts.
Track error and timing anomalies in proxy test responses that may indicate scanning behavior.

How to Mitigate CVE-2026-53549

Immediate Actions Required

Upgrade Termix to version 2.3.2 or later, available at the Termix 2.3.2 release page.
Restrict outbound network access from the Termix server to only the hosts and ports required for legitimate SSH tunneling operations.
Enforce IMDSv2 with hop-limit restrictions on AWS instances, and equivalent metadata protections on Azure and GCP, to block SSRF-based credential theft.

Patch Information

The issue is fixed in Termix version 2.3.2 via pull request #874 and commit 52f4e51ae03b5b8d2608e1383e2ccf79d290132b. The following patch snippet illustrates repository hygiene changes bundled with the release:

text

 lerna-debug.log*
 
 node_modules
+src/mcp-server/node_modules
 dist
 dist-ssr
+coverage
 *.local
 
 .vscode/

Source: Termix commit 52f4e51

Workarounds

If immediate upgrade is not possible, block access to the /host/db/proxy/test endpoint at a reverse proxy or web application firewall.
Apply network-layer egress controls to deny connections from the Termix host to loopback, RFC 1918, and link-local ranges except where explicitly required.
Rotate any cloud credentials, IAM role sessions, or secrets that may have been exposed through the instance metadata service prior to remediation.

bash

# Example nginx rule to block the vulnerable endpoint until patched
location = /host/db/proxy/test {
    deny all;
    return 403;
}