CVE-2026-53546

Received Received - Intake

Authenticated SSH Credential Exposure in Termix

Publication date: 2026-08-19

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When no credential is shared with the requester, resolveHostById performs an owner credential fallback, and src/backend/ssh/terminal.ts combines that credential with attacker-controlled ip, port, and username values. An authenticated low-privileged user can therefore make Termix authenticate to an attacker-controlled SSH server and disclose another user's stored SSH password or private-key material while the victim user's data key is unlocked. This issue is fixed in version 2.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-20

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-53546

EUVD

EUVD-2026-62859

Affected Vendors & Products

Vendor	Product	Version / Range
termix	termix	2.3.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Termix before 2.3.2 has a flaw in its terminal WebSocket handling. An authenticated low-privileged user can manipulate the hostConfig.id parameter to trick the system into connecting to an attacker-controlled SSH server. The system may then disclose another user's stored SSH credentials (password or private key) if their data key is unlocked.

Detection Guidance

This vulnerability requires detecting unauthorized SSH connections initiated by Termix. Monitor network traffic for unexpected SSH connections from Termix processes. Check Termix logs for unusual host resolution or authentication attempts. Inspect active SSH sessions linked to Termix users. Ensure Termix is updated to version 2.3.2 or later to mitigate the issue.

Impact Analysis

If you use Termix before version 2.3.2, an attacker with low privileges could gain access to your stored SSH credentials. This could allow them to impersonate you on SSH servers or access other systems where those credentials are used.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) requirements. Unauthorized credential exposure may result in compliance breaches depending on the data accessed.

Mitigation Strategies

Immediately upgrade Termix to version 2.3.2 or later to patch the vulnerability. Review user access controls and ensure low-privileged users cannot manipulate hostConfig.id or SSH terminal parameters. Monitor for unauthorized SSH connections or credential disclosures.

Hi! I’m here to help you understand CVE-2026-53546. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70