CVE-2026-79762: Termix Information Disclosure Vulnerability

CVE-2026-79762 Overview

CVE-2026-79762 affects Termix, a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. Versions from 1.7.0 until 2.5.1 derive Data Encryption Key (DEK) wrapping keys for OIDC and WebAuthn users from committed default strings and the public userId salt in src/backend/utils/user-crypto.ts. An attacker who obtains an offline copy of the SQLite database can derive the wrapping key, recover each affected user's DEK, and decrypt stored SSH passwords, private keys, and key passphrases. The flaw is categorized under [CWE-321: Use of Hard-coded Cryptographic Key]. Password-authenticated users are not affected. The issue is fixed in version 2.5.1.

Critical Impact
An attacker with read access to the Termix SQLite database can decrypt all stored SSH credentials for OIDC and WebAuthn users, enabling lateral movement across every server managed through the platform.

Affected Products

Termix versions 1.7.0 through 2.5.0
Default Termix deployments that do not set OIDC_SYSTEM_SECRET
Default Termix deployments that do not set WEBAUTHN_SYSTEM_SECRET

Discovery Timeline

2026-09-24 - CVE-2026-79762 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-79762

Vulnerability Analysis

Termix encrypts sensitive SSH material at rest using a per-user DEK. The DEK itself is wrapped with a key derived inside src/backend/utils/user-crypto.ts. For OIDC and WebAuthn authentication paths, the derivation inputs are two environment variables, OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET, combined with the user's userId.

The default deployment artifacts shipped with the project do not set either environment variable. The code falls back to hard-coded default strings that are present in the public source tree. The userId is not a secret and is directly readable from the same SQLite database that stores the wrapped DEKs and ciphertexts.

An attacker possessing an offline copy of the database has every input needed to reconstruct the wrapping key, unwrap each affected user's DEK, and decrypt stored SSH passwords, private keys, and passphrases. The attack is deterministic and offline, requiring no interaction with a running Termix instance.

Root Cause

The root cause is reliance on committed default secrets as cryptographic key material. When operators do not override OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET, the derivation becomes a public-knowledge function of a non-secret userId. This collapses the confidentiality guarantee of the DEK wrapping scheme.

Attack Vector

Exploitation requires local or filesystem-level access to the Termix SQLite database. Realistic access paths include a compromised backup, a stolen container volume, a misconfigured bind mount, or an operator with host-level privileges on the Termix server. Password-authenticated users are not impacted because their DEKs are wrapped using a key derived from the password rather than the hard-coded defaults.

The following patch content from the 2.5.1 release demonstrates project changes shipped alongside the security fix. The cryptographic correction is applied in src/backend/utils/user-crypto.ts and reviewed in GitHub Pull Request #1067.

text

 CONTRIBUTING.md
 LICENSE

-repo-images/
+docs/repo-images/

 uploads/

Source: GitHub Commit ddbdd5c

text

 # Stage 1: Install dependencies
-FROM node:24-slim AS deps
+FROM node:26-slim AS deps
 WORKDIR /app

 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*

Source: GitHub Commit ddbdd5c

Detection Methods for CVE-2026-79762

Indicators of Compromise

Termix container or host running a version between 1.7.0 and 2.5.0 with OIDC_SYSTEM_SECRET or WEBAUTHN_SYSTEM_SECRET unset in the environment.
Access, copy, or export events against the Termix SQLite database file by accounts that do not operate the service.
Unexpected SSH logins to downstream servers using credentials that were only stored inside Termix for OIDC or WebAuthn users.

Detection Strategies

Audit Termix deployment manifests, Compose files, and Kubernetes secrets to confirm whether the two system secret variables are explicitly set.
Review filesystem and backup access logs for reads of the Termix database path and any associated volume snapshots.
Correlate authentication telemetry on managed SSH targets against expected Termix session activity to identify out-of-band credential reuse.

Monitoring Recommendations

Alert on file access to the Termix SQLite database by processes other than the Termix server binary.
Monitor backup pipelines and object storage buckets that may contain copies of the Termix database for unauthorized retrieval.
Track SSH key and password usage on downstream servers after upgrading, using credential rotation as a baseline reset point.

How to Mitigate CVE-2026-79762

Immediate Actions Required

Upgrade Termix to version 2.5.1 or later, available in the GitHub Release 2.5.1.
Rotate all SSH passwords, private keys, and key passphrases that were stored in Termix for OIDC or WebAuthn users while on an affected version.
Treat any offline copy of the Termix database created on an affected version as compromised and purge it from backups where feasible.

Patch Information

The fix is delivered in Termix 2.5.1 through GitHub Pull Request #1067 and the associated commits 401ec7e and ddbdd5c. Full remediation guidance is published in GHSA-685g-ccvv-6p8m.

Workarounds

Set strong, unique values for OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET in the Termix process environment before granting any OIDC or WebAuthn user access.
Restrict filesystem permissions on the Termix SQLite database so only the service account can read it, and encrypt backups at rest with keys stored outside the Termix host.
Where upgrade is not immediately possible, limit OIDC and WebAuthn login paths and require password-based authentication, which is not affected by this derivation flaw.

bash

# Configuration example: set required system secrets before starting Termix
export OIDC_SYSTEM_SECRET="$(openssl rand -base64 48)"
export WEBAUTHN_SYSTEM_SECRET="$(openssl rand -base64 48)"

# Restrict access to the SQLite database file
chown termix:termix /var/lib/termix/termix.db
chmod 600 /var/lib/termix/termix.db