CVE-2026-53548

Received Received - Intake

Authentication Bypass in Termix via Password Endpoint

Publication date: 2026-08-19

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or field=sudoPassword query without enforcing host ownership during credential resolution. A failed requester-scoped lookup can resolve the host with the owner's context and return the owner's plaintext credential, allowing any authenticated user with a valid JWT to enumerate sequential hosts.id values and retrieve SSH or sudo passwords belonging to other users. The disclosed credentials can then be used to access and control managed systems outside the Termix instance. This issue is fixed in version 2.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-21

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-53548

EUVD

EUVD-2026-62857

Affected Vendors & Products

Vendor	Product	Version / Range
termix	termix	to 2.6.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Termix before version 2.6.1 allows authenticated users to access plaintext SSH or sudo passwords of other users by exploiting improper host ownership checks. The GET /host/db/host/:id/password endpoint returns credentials when queried with a numeric host ID and field=password or field=sudoPassword, even if the requester does not own the host. Attackers can enumerate sequential host IDs to retrieve credentials belonging to other users.

Detection Guidance

This vulnerability can be detected by checking if your Termix instance is running a version prior to 2.6.1. Use commands like 'curl -s http://<termix-server>/api/version' or check the package version if installed locally. Additionally, monitor for unauthorized access attempts or unusual credential retrieval patterns in logs.

Impact Analysis

If you use Termix before version 2.6.1, an attacker with a valid account could steal your SSH or sudo passwords. This could allow them to access and control your managed systems outside Termix, leading to unauthorized system access, data breaches, or further attacks on your infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive systems, potentially violating data protection requirements under GDPR or HIPAA. Exposure of plaintext credentials may result in non-compliance with security controls, leading to regulatory penalties or legal consequences.

Mitigation Strategies

Immediately upgrade Termix to version 2.6.1 or later. Revoke and rotate all exposed SSH and sudo passwords retrieved via the vulnerable endpoint. Review and restrict access logs for suspicious enumeration attempts of sequential host IDs.

Hi! I’m here to help you understand CVE-2026-53548. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70