CVE-2026-79759: Termix Auth Bypass Vulnerability

CVE-2026-79759 Overview

CVE-2026-79759 is an Insecure Direct Object Reference (IDOR) vulnerability in Termix, a web-based server management platform offering SSH terminal, tunneling, and file editing capabilities. The flaw affects versions 1.7.0 through 2.5.0. The POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values without validating record ownership. Authenticated users can enumerate credential and host records belonging to other tenants and trigger outbound SSH connection attempts using the attacker's public key against victim hosts. The issue is tracked under [CWE-639] and fixed in version 2.5.1.

Critical Impact
Authenticated attackers can enumerate other users' credentials and hosts, learn each record's authType, and coerce victim hosts into accepting outbound SSH connection attempts using the attacker's public key.

Affected Products

Termix versions 1.7.0 through 2.5.0
Vulnerable component: src/backend/database/routes/credentials.ts
Fixed in Termix 2.5.1

Discovery Timeline

2026-09-24 - CVE-2026-79759 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-79759

Vulnerability Analysis

The vulnerability resides in the credential deployment route defined in src/backend/database/routes/credentials.ts. The handler for POST /credentials/:id/deploy-to-host accepts credentialId and targetHostId integer parameters supplied by the caller. The route queries the database using only these identifiers and omits any check that the resolved rows belong to the requesting user.

Differential error responses expose record existence and the authType value of each matched row. Encrypted passwords and private keys remain protected. However, when a target host is configured for key-based authentication, Termix initiates an outbound SSH connection to that host using the attacker's public key. A victim host configured to trust that key would accept the connection attempt.

Root Cause

The root cause is missing authorization enforcement on database lookups. The vulnerable code filters rows using eq() on the record identifier alone. The fix introduces a compound predicate pairing the identifier with the authenticated user's identity, preventing cross-tenant resolution of credentials and hosts.

Attack Vector

An authenticated low-privilege Termix user issues a POST /credentials/:id/deploy-to-host request supplying arbitrary integer values for credentialId and targetHostId. By observing response differences, the attacker enumerates valid IDs and reads back the authType metadata. When a victim host trusts the attacker's SSH public key, the deploy flow triggers an outbound connection using the attacker's key material.

typescript

   CredentialBackend,
 } from "../../../types/index.js";
 import type { Request, RequestHandler, Response, Router } from "express";
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 import ssh2Pkg from "ssh2";
 import { db } from "../db/index.js";
 import { hosts, sshCredentials } from "../db/schema.js";

Source: GitHub Commit b0598294. The patch imports and from drizzle-orm so queries can combine record ID with the owning user ID in a single predicate.

Detection Methods for CVE-2026-79759

Indicators of Compromise

Unexpected POST /credentials/:id/deploy-to-host requests from accounts that do not own the referenced credential or host records.
Outbound SSH connection attempts from the Termix backend to hosts not associated with the initiating user.
Repeated requests enumerating sequential credentialId or targetHostId integer values.

Detection Strategies

Correlate Termix application logs with database audit trails to flag deploy-to-host calls where the resolved record owner differs from the request's session user.
Alert on burst patterns of /credentials/:id/deploy-to-host requests producing differential HTTP status codes consistent with ID enumeration.
Monitor SSH authentication logs on managed hosts for connection attempts presenting unexpected public keys sourced from Termix.

Monitoring Recommendations

Enable verbose request logging on the Termix API gateway, capturing authenticated user identity alongside path parameters.
Forward Termix backend and host-side sshd logs to a centralized analytics platform for cross-source correlation.
Track baseline deploy-to-host volume per user and alert on deviations that may indicate enumeration activity.

How to Mitigate CVE-2026-79759

Immediate Actions Required

Upgrade Termix to version 2.5.1 or later immediately.
Review audit logs for prior POST /credentials/:id/deploy-to-host calls where the request session user did not own the resolved records.
Rotate SSH keys and credentials for any hosts that may have received unauthorized deployment attempts.

Patch Information

The fix ships in Termix 2.5.1. The authorization change is implemented in GitHub Commit b0598294 and released via Pull Request #1067. See the GitHub Security Advisory GHSA-w4cf-69fj-g96f and the Termix v2.5.1 Release for details.

Workarounds

Restrict Termix access to a smaller set of trusted operators until the upgrade is applied.
Place the Termix backend behind a reverse proxy that enforces request-rate limits on /credentials/* endpoints.
Remove Termix-managed public keys from authorized_keys on hosts where deployment is not actively required.

bash

# Upgrade Termix container to the patched release
docker pull ghcr.io/termix-ssh/termix:release-2.5.1-tag
docker stop termix && docker rm termix
docker run -d --name termix \
  -p 8080:8080 \
  -v /opt/termix/data:/app/data \
  ghcr.io/termix-ssh/termix:release-2.5.1-tag