CVE-2026-53548: critical vulnerability in Termix-SSH Termix
Termix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.6epss 0.5%
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or field=sudoPassword query without enforcing host ownership during credential resolution. A failed requester-scoped lookup can resolve the host with the owner's context and return the owner's plaintext credential, allowing any authenticated user with a valid JWT to enumerate sequential hosts.id values and retrieve SSH or sudo passwords belonging to other users. The disclosed credentials can then be used to access and control managed systems outside the Termix instance. This issue is fixed in version 2.6.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected products
Termix-SSH · TermixRelated CVEs — Termix-SSH Termix
In the same product, most dangerous first.
CVE-2026-45744CRITICALTermix has an OS Command Injection in File Manager resolvePath endpointEPSS 2.0%CVE-2026-45748CRITICALTermix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command InjectionEPSS 1.7%CVE-2026-42453HIGHTermix: Command injection in extractArchive/compressFiles via double-quote escaping bypassEPSS 1.2%CVE-2026-53545CRITICALTermix: Remote Code Execution via Tunnel Disconnect pkill Command InjectionEPSS 0.7%CVE-2026-53542HIGHTermix: Tar option injection in file-manager archive creation allows command execution on managed SSH hostsEPSS 0.7%CVE-2026-42454CRITICALTermix: OS Command Injection in Docker Container Management EndpointsEPSS 0.7%