CVE-2026-79760
Received Received - Intake

Authenticated Blind SSRF in Termix via Notification Channels

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests through the notification-channel test endpoint. The request path in src/backend/database/routes/alert-rules-routes.ts reaches src/backend/utils/notification-sender.ts without destination allowlisting or private-address blocking. This permits blind requests to internal HTTP services reachable by the Termix server. Webhook mode also permits attacker-controlled HTTP methods and headers, which can cause limited state changes when an internal service accepts the fixed notification body, although response bodies are not returned. This issue is fixed in version 2.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-79760
EUVD
EUVD-2026-86254

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
termix termix 2.5.0
termix termix 2.5.1
termix termix From 2.5.0 (inc) to 2.5.2 (exc)
termix termix to 2.5.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a blind Server-Side Request Forgery (SSRF) vulnerability in Termix versions 2.5.0 to 2.4.9. Authenticated users can create webhook or ntfy notification channels with attacker-controlled URLs and trigger server-side HTTP requests through a test endpoint. The system lacks destination allowlisting or private-address blocking, allowing requests to internal services reachable by the Termix server.

Detection Guidance

To detect this vulnerability, monitor outbound HTTP requests from your Termix server, especially those triggered by notification channel tests. Check for requests to internal or private IP addresses, unusual HTTP methods, or headers in webhook configurations. Review server logs for suspicious activity in the notification-sender.ts or alert-rules-routes.ts files.

Impact Analysis

An attacker could exploit this to send requests to internal services, potentially causing limited state changes if those services accept the fixed notification body. While response bodies are not exposed, the attack could lead to unauthorized actions or data exfiltration from internal systems reachable by Termix.

Compliance Impact

This SSRF vulnerability could expose internal services to unauthorized access, potentially violating data protection requirements under GDPR (e.g., unauthorized data access) or HIPAA (e.g., unauthorized access to protected health information). Compliance may be impacted if internal systems handle sensitive data.

Mitigation Strategies
  • Upgrade Termix to version 2.5.1 or later to apply the security fixes.
  • Restrict notification channel destinations to trusted HTTP/HTTPS URLs and block private or loopback addresses.
  • Review and validate all existing notification channels for unauthorized or suspicious configurations.
  • Implement network-level controls to block outbound requests to internal or restricted IP ranges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79760. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart