CVE-2026-79758: Termix: Authenticated users can read other users' host status and clear global SSH connections
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET /status/:id accepts an attacker-supplied numeric host identifier, and POST /clear-connections permits a regular user to clear the global SSH connection pool. The affected src/backend/ssh/server-stats.ts routes expose host online or offline state and lastChecked timestamps and can disrupt other users' active sessions or pooled connections. Unauthenticated requests remain blocked, but authentication alone does not preserve tenant isolation. This issue is fixed in version 2.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termixto a version that resolves this vulnerability.Fixed in 2.5.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Termix user can exploit it. Unauthenticated requests are blocked, but a regular user does not need host-specific access to query status data or clear the global SSH connection pool.
What information and impact are exposed?
A user can retrieve online or offline status and lastChecked timestamps for hosts they are not authorized to access. They can also clear the global SSH connection pool, which can disrupt other users' active sessions or pooled connections.
Which deployments are affected?
Termix versions from 1.8.0 until 2.5.1 are affected. The issue concerns the server-stats routes, including GET /status, GET /status/:id, and POST /clear-connections.
How can I remediate the issue?
Upgrade Termix to version 2.5.1, which fixes the issue.