Vulnerability · Published Aug 19, 2026 · Assigned by GitHub_M

CVE-2026-53546Termix: Missing authorization in SSH host credential resolution exposes stored credentials

Critical 9.6

In plain English

A critical-severity authorization bypass via user-controlled key in Termix from Termix-SSH. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)0.5%top 59.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When no credential is shared with the requester, resolveHostById performs an owner credential fallback, and src/backend/ssh/terminal.ts combines that credential with attacker-controlled ip, port, and username values. An authenticated low-privileged user can therefore make Termix authenticate to an attacker-controlled SSH server and disclose another user's stored SSH password or private-key material while the victim user's data key is unlocked. This issue is fixed in version 2.3.2.

Affected products (as reported)

Vendor	Product	Versions
Termix-SSH	Termix	< 2.3.2

Weakness: CWE-639, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/Termix-SSH/Termix/security/advisories/GHSA-57gp-39c7-4g9r x_refsource_CONFIRM
https://github.com/Termix-SSH/Termix/pull/874 x_refsource_MISC
https://github.com/Termix-SSH/Termix/commit/52f4e51ae03b5b8d2608e1383e2ccf79d290132b x_refsource_MISC
https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag x_refsource_MISC