CVE-2026-79761: Termix SSH Key Deployment RCE Vulnerability

CVE-2026-79761 Overview

Termix is a web-based server management platform providing SSH terminal access, tunneling, and remote file editing. CVE-2026-79761 is a command injection vulnerability [CWE-78] affecting Termix versions 1.7.0 through 2.5.0. The SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. An authenticated user who can deploy a crafted SSH credential can execute arbitrary commands with the privileges of the targeted remote account. The issue is fixed in version 2.5.1.

Critical Impact
Authenticated users with credential deployment privileges can achieve remote command execution on managed hosts under the selected remote account context.

Affected Products

Termix versions 1.7.0 through 2.5.0
src/backend/database/routes/credential-deploy-routes.ts module
Termix SSH key deployment workflow

Discovery Timeline

2026-09-24 - CVE-2026-79761 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-79761

Vulnerability Analysis

The vulnerability resides in Termix's SSH key deployment flow in src/backend/database/routes/credential-deploy-routes.ts. The backend parses a user-supplied public key, extracts the key payload token, and uses it as a keyPattern argument interpolated into a double-quoted shell command executed over SSH on the remote host.

Both grep -F verification paths accept the pattern without sanitization. An authenticated attacker can embed command substitution syntax such as backticks or $(...), or quote-breaking characters, inside the public-key token. When the backend concatenates this value into the remote shell string, the injected payload executes with the privileges of the selected remote account.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The keyPattern variable, derived from keyParts[1], was passed directly into a template literal forming a shell command without validation that it conformed to a Base64 public-key charset.

Attack Vector

Exploitation requires an authenticated session with permissions to deploy an SSH credential to a target host. The attacker crafts a public key whose second whitespace-separated token contains shell metacharacters. During deployment, Termix opens an SSH connection and executes the interpolated verification command, triggering command execution on the remote endpoint.

typescript

            }

            const keyPattern = keyParts[1];
+            if (!/^[A-Za-z0-9+/]+={0,2}$/.test(keyPattern)) {
+              clearTimeout(checkTimeout);
+              return rejectCheck(new Error("Invalid public key data"));
+            }

            conn.exec(
              `if [ -f ~/.ssh/authorized_keys ]; then grep -F "${keyPattern}" ~/.ssh/authorized_keys >/dev/null 2>&1; echo $?; else echo 1; fi`,

Source: GitHub Commit fafff94. The patch introduces a strict Base64 regular expression check on keyPattern and rejects any value containing characters outside the public-key charset.

Detection Methods for CVE-2026-79761

Indicators of Compromise

SSH credential deployment events referencing public keys whose second token contains backticks, $(, ;, |, &, or double-quote characters.
Unexpected child processes spawned under remote accounts shortly after a Termix credential deployment action.
Entries in ~/.ssh/authorized_keys or related shell history that correlate with Termix deployment timestamps and non-standard key formats.

Detection Strategies

Audit Termix application logs for calls to the credential deployment routes with public-key payloads failing Base64 validation.
Monitor SSH sessions originating from the Termix service account for grep -F invocations followed by anomalous commands on target hosts.
Review version banners of deployed Termix instances to identify installations prior to 2.5.1.

Monitoring Recommendations

Enable verbose auth logging on managed hosts to capture command execution tied to Termix-initiated SSH sessions.
Alert on process executions whose parent is sshd and whose command line contains shell substitution patterns inside quoted strings.
Track EDR telemetry for new persistence artifacts written to .ssh/ directories on hosts targeted by Termix.

How to Mitigate CVE-2026-79761

Immediate Actions Required

Upgrade Termix to version 2.5.1 or later across all deployments.
Restrict credential deployment permissions to a minimal set of trusted administrators until the upgrade is complete.
Rotate SSH keys and review authorized_keys files on hosts that received deployments from vulnerable Termix versions.

Patch Information

The fix is published in GitHub Release 2.5.1 and merged via Pull Request #1067. The validation change in credential-deploy-routes.ts is tracked in commit fafff94, with supporting changes in commit ddbdd5c. Full details are in the GHSA-p2g3-2xq3-23gx advisory.

Workarounds

Disable the SSH key deployment feature or block the affected API routes at a reverse proxy until the patch is applied.
Limit Termix's SSH service account on target hosts to a restricted shell or forced command to constrain the blast radius of any injection.
Enforce multi-admin review for new credential deployments to reduce the risk of a single compromised account triggering exploitation.

bash

# Verify the installed Termix version and upgrade
docker inspect termix --format '{{.Config.Image}}'
docker pull ghcr.io/termix-ssh/termix:release-2.5.1-tag
docker compose up -d termix