CVE-2026-79758: Termix Authorization Bypass Vulnerability

CVE-2026-79758 Overview

CVE-2026-79758 is a broken access control vulnerability [CWE-284] in Termix, a web-based server management platform offering SSH terminal, tunneling, and file editing capabilities. The flaw affects versions 1.8.0 through 2.5.0 and resides in the src/backend/ssh/server-stats.ts routes. Authenticated users can call the server-stats API without per-host authorization checks. This allows any logged-in tenant to enumerate host status for machines they do not own and to clear the global SSH connection pool, disrupting other users' sessions. The issue is fixed in version 2.5.1.

Critical Impact

Any authenticated Termix user can read host online/offline state for other tenants and terminate pooled SSH connections across the entire deployment, breaking multi-tenant isolation.

Affected Products

• Termix versions 1.8.0 through 2.5.0
• src/backend/ssh/server-stats.ts route handlers
• Deployments exposing the Termix web management platform to multiple authenticated users

Discovery Timeline

• 2026-09-24 - CVE CVE-2026-79758 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-79758

Vulnerability Analysis

The Termix backend exposes three server-stats endpoints that enforce authentication but omit tenant-level authorization. GET /status returns status objects for every registered host rather than filtering by the requester's accessible hosts. GET /status/:id accepts an attacker-supplied numeric host identifier and responds with the host's online or offline state and lastChecked timestamp without verifying ownership. POST /clear-connections resets the global SSH connection pool shared across all tenants.

The exposed data permits reconnaissance of foreign infrastructure, including host inventory enumeration and uptime pattern analysis. The connection-pool clear operation enables a low-privilege user to interrupt active SSH sessions and pooled connections belonging to other users, producing a cross-tenant denial of service. Unauthenticated requests remain blocked, but authentication alone does not preserve tenant isolation.

Root Cause

The server-stats route handlers in src/backend/ssh/server-stats.ts verify only session authentication. They do not consult the per-host authorization layer that other Termix APIs use to scope responses to hosts the requester owns or has been granted access to. The /clear-connections endpoint also lacks a role check, treating any authenticated principal as privileged to manage the global pool.

Attack Vector

An authenticated low-privilege Termix user issues HTTP requests to the vulnerable endpoints. Enumerating sequential integer values against GET /status/:id reveals which host IDs exist and their current reachability. Issuing POST /clear-connections forcibly drops the shared SSH connection pool and interrupts other users' sessions.

Technical details are available in the GitHub Security Advisory GHSA-372w-6f3h-vcm4 and the GitHub Pull Request #1067.

Detection Methods for CVE-2026-79758

Indicators of Compromise

• HTTP access logs showing requests to /status, /status/:id, or /clear-connections from user accounts not associated with the targeted host IDs.
• Sequential or scripted enumeration patterns against GET /status/:id with incrementing numeric identifiers.
• Unexpected POST /clear-connections calls followed by widespread SSH session reconnections or user complaints about dropped sessions.

Detection Strategies

• Correlate the authenticated user identity in Termix access logs against the host ownership table to flag /status/:id requests targeting hosts outside the user's authorized scope.
• Alert on any POST /clear-connections request issued by a non-administrator account.
• Monitor for high request rates against the /status family of endpoints indicative of inventory enumeration.

Monitoring Recommendations

• Enable verbose request logging on the Termix backend and ship logs to a centralized SIEM for retention and query.
• Baseline normal /status call volume per user and alert on deviations exceeding that baseline.
• Track SSH connection pool reset events alongside downstream session termination counts to identify abuse of /clear-connections.

How to Mitigate CVE-2026-79758

Immediate Actions Required

• Upgrade Termix to version 2.5.1 or later, which is the fixed release.
• Audit existing Termix user accounts and remove accounts that no longer require access to the platform.
• Review historical access logs for the three affected endpoints to identify prior enumeration or disruption attempts.

Patch Information

The fix is included in Termix release 2.5.1. Review the GitHub Release 2.5.1 notes and the fix commit in the GitHub Commit Log. The patch bundle in pull request #1067 also updates container build inputs:

 # Stage 1: Install dependencies
-FROM node:24-slim AS deps
+FROM node:26-slim AS deps
 WORKDIR /app

 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*

Source: GitHub Commit ddbdd5c

Workarounds

• If upgrading immediately is not possible, restrict Termix access to a single trusted administrator account until version 2.5.1 can be deployed.
• Place the Termix backend behind a reverse proxy that blocks or rate-limits requests to /status, /status/:id, and /clear-connections from non-administrator sessions.
• Rotate pooled SSH credentials after confirming no unauthorized pool clears have been issued.

# Example nginx reverse-proxy rule restricting the affected endpoints
location ~ ^/(status(/.*)?|clear-connections)$ {
    allow 10.0.0.5;      # admin workstation
    deny all;
    proxy_pass http://termix_backend;
}