CVE-2026-53549: Termix: Server-Side Request Forgery via Proxy Connectivity Test
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The testProxyConnectivity path uses raw TCP and SOCKS connections to attacker-selected hosts and ports, allowing an authenticated user to probe localhost, private networks, link-local metadata services, and other infrastructure reachable from the Termix server. Structured connection errors disclose host reachability and timing information, and successful metadata access can expose cloud credentials. This issue is fixed in version 2.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termixto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Termix user can exploit it by sending requests to the POST /host/db/proxy/test endpoint. The vulnerable behavior lets that user make the Termix server attempt connections to hosts and ports selected by the user.
What systems or data may be reachable through the vulnerable server?
Targets reachable from the Termix server may include localhost services, private-network hosts, link-local metadata services, and other internal infrastructure. Connection errors can reveal reachability and timing information, while successful access to cloud metadata services may expose cloud credentials.
Are default deployments affected?
The provided information does not identify a configuration prerequisite beyond an affected Termix version and access to the endpoint as an authenticated user. The endpoint accepts the relevant proxy and target fields without destination-address validation.
What should be done if upgrading cannot happen immediately?
Restrict authenticated access to Termix to trusted users, since exploitation requires authentication. Limit the Termix server's network access to localhost, private networks, link-local metadata services, and other sensitive destinations where possible.
How can I determine whether my instance is affected?
Termix versions prior to 2.3.2 are affected. Version 2.3.2 contains the fix.