CVE-2026-79764: Termix SSRF Information Disclosure Flaw

CVE-2026-79764 Overview

CVE-2026-79764 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Termix, a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. The flaw affects versions 2.5.0 through 2.5.0 and is fixed in version 2.5.1. The /homepage/proxy endpoint accepts an authenticated user's url query parameter and forwards it to http.get or https.get without destination restrictions. An authenticated attacker, including a self-registered low-privilege account, can reach internal services and cloud metadata endpoints.

Critical Impact
Authenticated attackers can exfiltrate internal service data and cloud instance credentials by proxying requests to loopback, RFC1918, link-local, and cloud metadata destinations.

Affected Products

Termix 2.5.0
Termix versions prior to 2.5.1
Deployments exposing /homepage/proxy to authenticated users

Discovery Timeline

2026-09-24 - CVE-2026-79764 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-79764

Vulnerability Analysis

The vulnerability resides in src/backend/database/routes/homepage-proxy-routes.ts. The handler receives a user-supplied url query parameter and constructs a new URL(...) object. That constructor performs only syntactic parsing, not destination filtering. The route then invokes http.get or https.get against the parsed URL and returns the complete JSON response body to the caller.

Because no allowlist or network-range check exists, the request can target the loopback interface (127.0.0.1), RFC1918 private ranges (10.0.0.0/8, 192.168.0.0/16), link-local addresses (169.254.0.0/16), and cloud metadata services. Attackers can request http://169.254.169.254/latest/meta-data/iam/security-credentials/ on AWS or the equivalent endpoints on Azure and GCP to obtain instance role credentials.

Root Cause

The root cause is missing destination validation on a server-side fetch primitive. The code trusts URL syntax as a security boundary. Allowing arbitrary user-controlled destinations in a server-initiated HTTP client is the canonical pattern described by [CWE-918].

Attack Vector

Exploitation requires an authenticated account. Termix supports self-registration in some configurations, lowering the barrier. The attacker submits a crafted request such as GET /homepage/proxy?url=http://169.254.169.254/latest/meta-data/ and receives the fetched content directly in the HTTP response.

typescript

// Patch snippet - src/backend/database/routes/homepage-proxy-routes.ts
 import express from "express";
 import https from "https";
 import http from "http";
+import { lookup } from "dns/promises";
+import { BlockList, isIP } from "net";
 import { homepageLogger } from "../../utils/logger.js";

 export const homepageProxyRouter = express.Router();

Source: GitHub Commit 4b2a60a. The fix introduces dns/promises lookup and a net.BlockList to reject private, loopback, and link-local destinations before issuing the outbound request.

Detection Methods for CVE-2026-79764

Indicators of Compromise

Requests to /homepage/proxy with url parameters pointing to 127.0.0.1, localhost, RFC1918 ranges, or 169.254.169.254.
Outbound HTTP connections from the Termix host to cloud metadata endpoints (169.254.169.254, metadata.google.internal, 169.254.169.254/metadata/instance for Azure).
Unusual response sizes from /homepage/proxy that correlate with internal service payloads.
Low-privilege or newly registered accounts generating heavy proxy traffic.

Detection Strategies

Parse Termix application logs for the /homepage/proxy route and extract the url query parameter for allowlist comparison.
Alert on any decoded destination that resolves to a private, loopback, or link-local IP.
Correlate authenticated session identifiers with proxy request volume to surface credential-stuffing or recon activity.

Monitoring Recommendations

Enable egress flow logging on the subnet hosting Termix and alert on connections to metadata IPs.
Capture reverse-proxy or ingress logs retaining full request URIs for the Termix backend.
Monitor cloud provider audit trails for use of instance role credentials from unexpected source IPs.

How to Mitigate CVE-2026-79764

Immediate Actions Required

Upgrade Termix to version 2.5.1 or later immediately.
Rotate any cloud instance credentials, API keys, and secrets reachable from the Termix host.
Audit Termix user accounts and disable self-registration if not required.
Review application logs for prior exploitation of /homepage/proxy.

Patch Information

The fix is included in Termix Release 2.5.1 and delivered through Pull Request #1067. Technical details are documented in GitHub Security Advisory GHSA-mwr3-35ph-pjqg. The patched handler validates resolved IP addresses against a BlockList of private, loopback, and link-local ranges before issuing the outbound request.

Workarounds

Block the /homepage/proxy route at the reverse proxy if the homepage feature is not in use.
Enforce IMDSv2 on AWS and require session tokens for metadata access.
Restrict Termix egress with a network policy that denies traffic to RFC1918 and 169.254.0.0/16.
Place Termix behind a network boundary that cannot reach sensitive internal services.

bash

# Example egress restriction using iptables on the Termix host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT