CVE-2026-53549

Received Received - Intake

Remote TCP Proxy Connection Bypass in Termix

Publication date: 2026-08-19

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The testProxyConnectivity path uses raw TCP and SOCKS connections to attacker-selected hosts and ports, allowing an authenticated user to probe localhost, private networks, link-local metadata services, and other infrastructure reachable from the Termix server. Structured connection errors disclose host reachability and timing information, and successful metadata access can expose cloud credentials. This issue is fixed in version 2.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-25

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-53549

EUVD

EUVD-2026-62855

Affected Vendors & Products

Vendor	Product	Version / Range
termix	termix	to 2.3.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Termix before version 2.3.2 has an issue where the POST /host/db/proxy/test endpoint does not validate destination addresses in the singleProxy, proxyChain, and testTarget fields. This allows authenticated users to use raw TCP and SOCKS connections to probe hosts and ports of their choice, including localhost, private networks, and metadata services. Connection errors and timing information may reveal host reachability, and successful access to metadata services could expose cloud credentials.

Detection Guidance

Check Termix version with 'curl -s http://<termix-server>/api/version' or similar. If below 2.3.2, the vulnerability may exist. Monitor network traffic for unexpected outbound connections from the Termix server to localhost, private networks, or metadata services.

Impact Analysis

If you use Termix versions before 2.3.2, an attacker with authenticated access could probe internal systems, discover network topology, or extract sensitive data like cloud credentials from metadata services. This could lead to unauthorized access to internal resources or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized network probing and data exposure, violating confidentiality and access control requirements in GDPR and HIPAA. It may result in data breaches, unauthorized access to personal or health data, and non-compliance with security and privacy controls.

Mitigation Strategies

Upgrade Termix to version 2.3.2 or later immediately. Restrict network access to the Termix server to prevent unauthorized probing. Review logs for suspicious proxy connectivity tests targeting internal or cloud infrastructure.

Hi! I’m here to help you understand CVE-2026-53549. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70