What is the CVSS score of CVE-2026-45743?

CVE-2026-45743 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Termix are affected by CVE-2026-45743?

Termix versions prior to 2.3.2 allow any authenticated user to hijack other users' SSH sessions and execute commands on their hosts in multi-tenant deployments, creating direct risk of cross-tenant…. A patch is available.

How to fix or mitigate CVE-2026-45743?

24 hours: Inventory all Termix deployments and confirm version numbers; identify which instances are used in multi-tenant or shared access scenarios. 7 days: Implement network segmentation to isolate SSH access by tenant; restrict API access to the 16 vulnerable file-manager endpoints; enforce API request authentication and ownership validation. 30 days: Deploy monitoring for abnormal sessionId usage and cross-tenant SSH access; conduct forensic review of SSH host access logs for signs of exploitation since Termix deployment.

Termix CVE-2026-45743

EUVD-2026-34872 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-05 GitHub_M

Authentication Bypass Termix Termix Ssh

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 05, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 05, 2026 - 18:41 vuln.today

Analysis Generated

Jun 05, 2026 - 18:41 vuln.today

DescriptionGitHub Advisory

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. 16 file-manager endpoints in Termix prior to version 2.3.2 do not verify that the requesting user owns the SSH session identified by sessionId. An authenticated attacker who knows or guesses another user's active sessionId can read, write, delete, download, and execute files on the victim's connected SSH host. Version 2.3.2 patches the issue.

AnalysisAI

Cross-tenant SSH session hijacking in Termix versions prior to 2.3.2 allows any authenticated user to fully control another user's connected SSH host via predictable session identifiers. Sixteen file-manager endpoints fail to verify ownership of the sessionId parameter, enabling read, write, delete, download, and execute operations on victim hosts. No public exploit identified at time of analysis, but the multi-tenant deployment model and low attack complexity make this a high-priority issue for shared installations.

Technical ContextAI

Termix is a self-hosted web-based server management platform that brokers SSH terminal access, tunneling, and file editing through a browser frontend. The flaw is a classic CWE-639 (Authorization Bypass Through User-Controlled Key) - sixteen file-manager API endpoints accept a sessionId parameter to identify which SSH session to operate against, but never check that the calling user actually owns that session. Because SSH sessions in Termix represent already-authenticated connections to backend hosts, abusing someone else's session inherits their SSH privileges on the target server, effectively turning a missing authorization check into remote command execution on third-party infrastructure. The affected CPE is cpe:2.3:a:termix-ssh:termix prior to 2.3.2.

RemediationAI

Vendor-released patch: upgrade to Termix release-2.3.2 or later, available from https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag, which adds the missing ownership checks on the 16 file-manager endpoints per GHSA-5fqh-77cr-jj5x. If immediate upgrade is not possible, restrict the Termix instance to a single trusted user or place it behind a reverse proxy that limits which authenticated accounts can reach the file-manager API paths - note that this defeats Termix's multi-user value proposition. As an interim measure, terminate long-lived SSH sessions promptly to shrink the window during which a valid sessionId could be guessed or harvested, accepting the usability cost of forcing reconnections, and audit existing accounts to remove any not strictly required.