CVE-2026-53546: Termix: Missing authorization in SSH host credential resolution exposes stored credentials
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When no credential is shared with the requester, resolveHostById performs an owner credential fallback, and src/backend/ssh/terminal.ts combines that credential with attacker-controlled ip, port, and username values. An authenticated low-privileged user can therefore make Termix authenticate to an attacker-controlled SSH server and disclose another user's stored SSH password or private-key material while the victim user's data key is unlocked. This issue is fixed in version 2.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termixto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privileged Termix user can exploit it. The attacker needs to be able to interact with the terminal WebSocket and supply a host configuration ID along with SSH connection values.
What conditions are required for credential disclosure?
The targeted host configuration must resolve to another user's credential through the owner credential fallback, and that victim user's data key must be unlocked. The attacker also needs an SSH server they control so Termix will attempt authentication using the exposed credential material.
Are deployments affected by default?
The issue is in the authorization behavior of SSH host credential resolution before version 2.3.2. The provided information does not identify a configuration setting or feature toggle that disables the affected behavior.
What should be done if an immediate upgrade is not possible?
The provided information does not document a workaround. Until version 2.3.2 can be deployed, limiting low-privileged user access to the terminal functionality and protecting access to stored SSH credentials can reduce exposure.
How can administrators determine whether they are affected?
Termix versions prior to 2.3.2 are affected. Review terminal WebSocket activity for low-privileged users supplying host configuration IDs they do not own or have explicit access to, especially where connection targets, ports, or usernames differ from the stored host configuration.