EUVD-2026-62859Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Network WebSocket, low-priv authenticated user (PR:L), no interaction; scope change (S:C) as another user's credentials leak, enabling downstream compromise (C:H/I:H), no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When no credential is shared with the requester, resolveHostById performs an owner credential fallback, and src/backend/ssh/terminal.ts combines that credential with attacker-controlled ip, port, and username values. An authenticated low-privileged user can therefore make Termix authenticate to an attacker-controlled SSH server and disclose another user's stored SSH password or private-key material while the victim user's data key is unlocked. This issue is fixed in version 2.3.2.
AnalysisAI
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated low-privileged user to steal another user's stored SSH password or private key. The terminal WebSocket trusts a user-supplied hostConfig.id, and the host resolver falls back to the host owner's credentials without an ownership or access check, then pairs that credential with the attacker's own ip/port/username so Termix authenticates to an attacker-controlled SSH server and leaks the secret. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated low-privileged Termix account (PR:L) on a multi-user instance, and the target victim's stored credential must be decryptable at request time - i.e., the victim's data key must currently be unlocked. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged Termix user stands up an SSH server they control, then opens a terminal session supplying a victim's hostConfig.id together with their own attacker ip/port/username. Termix resolves the victim's stored credential via the owner-credential fallback and authenticates outward to the attacker's server, which records the victim's SSH password or private key for reuse against the victim's real infrastructure. … |
| Remediation | Vendor-released patch: upgrade to Termix 2.3.2, which fixes the flaw via PR #874 (commit 52f4e51ae03b5b8d2608e1383e2ccf79d290132b); the patched release is https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag and the advisory is https://github.com/Termix-SSH/Termix/security/advisories/GHSA-57gp-39c7-4g9r. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Termix instances and their current versions, with particular attention to systems with broad user access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Docker default credentials in Termix server management. PoC and patch available.
Stored XSS in Termix File Manager (versions 1.7.0-1.9.0) allows attackers with SSH server access to execute arbitrary Ja
Remote command execution in Termix web-based server management platform (versions prior to 2.3.2) allows any authenticat
Remote code execution in Termix (self-hosted web-based server management platform) before version 2.1.0 lets an authenti
OS command injection in Termix web-based server management platform prior to version 2.3.2 allows remote unauthenticated
OS command injection in Termix (self-hosted web SSH/tunneling platform) before 2.3.2 lets an authenticated user who can
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticate
Cross-tenant remote code execution in Termix (web-based SSH/file management platform) prior to version 2.3.2 allows an a
Command injection in Termix server management platform before version 2.3.2 allows authenticated users to execute arbitr
Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-
Unauthorized data exposure in Termix prior to 2.3.2 allows a low-privileged authenticated user to exfiltrate password-re
Command injection in Termix (a self-hosted web-based SSH/server-management platform) before version 2.1.0 lets attackers
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today