CVE-2026-53546

Executive Summary

CVE-2026-53546 is a critical authorization-bypass vulnerability (CWE-639: Authorization Bypass Through User-Controlled Key) affecting Termix, a web-based server management platform with SSH terminal, tunneling, and file editing capabilities, prior to version 2.3.2. An authenticated low-privileged user can exploit a flaw in the terminal WebSocket's host-resolution logic to force the server to disclose another user's stored SSH credentials (password or private key) by making Termix connect to an attacker-controlled SSH server. The vulnerability carries a CVSS score of 9.6 (Critical) with a network attack vector, low attack complexity, no user interaction required, and a high impact on confidentiality and integrity with scope change. The flaw is confirmed fixed in version 2.3.2, but no patch evidence from tracked sources was available at the time of analysis, and no public exploit code or proof-of-concept has been identified.

Technical Analysis

The vulnerability resides in the interaction between two backend components of Termix. According to the NVD description, the terminal WebSocket endpoint accepts a user-controlled hostConfig.id parameter. This parameter is subsequently passed to the host resolution logic in src/backend/ssh/host-resolver.ts. The described flaw is that this resolver does not verify ownership of the specified host identifier nor require explicit access rights before resolving the host.

The critical sub-flaw lies in the credential fallback mechanism. When a requesting user has not been explicitly shared a credential for the target host, the resolveHostById function performs an "owner credential fallback" — meaning it retrieves the credential belonging to the host's owner rather than rejecting the request. This retrieved credential is then supplied to the connection establishment logic in src/backend/ssh/terminal.ts, which combines the owner's stored SSH credential with attacker-controlled ip, port, and username values supplied by the low-privileged requester.

The attack mechanism is a classic CWE-639 (Authorization Bypass Through User-Controlled Key) pattern: the application trusts a user-supplied identifier (hostConfig.id) to reference a server-side object (a saved SSH host configuration) without performing an authorization check that the requester is permitted to access that object. Because the credential is decrypted and combined with attacker-controlled connection parameters, the attacker can instruct Termix to authenticate to their own SSH server using the victim's stored credential. This results in the exfiltration of the victim's plaintext SSH password or private key material, which is transmitted during the SSH handshake to the attacker-controlled endpoint.

The attack requires that the victim user's "data key" be unlocked (i.e., the victim has an active session or the keyring is decrypted), making the timing of exploitation dependent on the victim's activity. The vulnerability is classified as high severity (CVSS 9.6) primarily because it requires only low privileges (any authenticated user), has low attack complexity, requires no user interaction, and results in full compromise of SSH credentials with a scope change indicating the impact extends beyond the vulnerable component.

The NVD description provides insufficient technical detail regarding the exact authentication flow within the WebSocket handshake, the precise structure of the hostConfig object, or the encryption scheme protecting stored credentials. However, the described mechanism clearly indicates an access-control failure at the object-reference level. The fact that version 2.3.2 addresses the issue suggests the fix likely introduces an ownership/authorization check in either host-resolver.ts or the WebSocket handler before resolving the host identifier.

Exploitation Scenarios

Scenario 1: Internal Multi-Tenant Server Management Platform

Step 1 — Reconnaissance/Target Identification: An authenticated low-privileged user (e.g., a user with viewer permissions or a newly provisioned account) enumerates other users' host configurations. The attacker identifies a target host configuration ID (hostConfig.id) belonging to a higher-privileged user. In a typical Termix deployment, host configurations are stored centrally, and the IDs may be sequential or predictable, allowing enumeration.

Step 2 — Triggering the Flaw: The attacker stands up an SSH server on infrastructure they control (or uses a cloud instance with a known public IP). They craft a WebSocket message to the terminal endpoint, supplying the victim's hostConfig.id along with attacker-controlled ip (their own server), a port of their choosing (e.g., 22), and a username that matches the stored configuration or a value of their choosing. Because the platform lacks an ownership check, the request proceeds.

Step 3 — Payload/Execution at Vulnerability-Class Level: The server's resolveHostById function performs the owner credential fallback, retrieving the stored credential object for the victim's host configuration. The terminal connection logic then combines this credential with the attacker-supplied network parameters and initiates an SSH connection to the attacker's server. Upon connection, the SSH client authenticates to the attacker's SSH daemon using the victim's stored password or private key.

Step 4 — Post-Exploitation Impact: The attacker's SSH server logs the authentication attempt, capturing the plaintext password or the private key material used during the handshake. The attacker now possesses the victim's SSH credentials and can use them to access the victim's legitimate infrastructure — any servers the victim manages via Termix. This provides lateral movement capabilities, potential for further credential harvesting, and access to sensitive data on the victim's managed hosts.

Additional Attack Vectors: The same flaw can be used for data exfiltration of multiple users' credentials systematically by iterating through host configuration IDs. The attacker does not require the victim to be actively using the platform, only that the victim's data key is unlocked (i.e., the victim has authenticated recently and their credential vault decryption key is in memory or otherwise active).

No public PoC is available for this vulnerability. The attack chain described above is inferred from the vulnerability class (CWE-639) and the explicit details provided in the NVD description regarding the affected functions and the credential fallback mechanism.

Impact Assessment

The vulnerability has a CVSS base score of 9.6 (Critical). The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) indicates:

• Attack Vector: Network — Exploitable remotely over the network.
• Attack Complexity: Low — No special conditions beyond standard access.
• Privileges Required: Low — Any authenticated user of the platform.
• User Interaction: None — Victim need not perform any action at the time of attack.
• Scope: Changed — The impact extends beyond the Termix platform to the victim's SSH-managed infrastructure.
• Confidentiality Impact: High — Complete disclosure of stored SSH credentials.
• Integrity Impact: High — Attacker can use captured credentials to modify data on target systems.
• Availability Impact: None — No denial-of-service condition described.

Business Impact: Organizations using Termix as their central server administration platform face a severe risk of credential theft. The compromised SSH credentials typically provide administrative-level access to production servers, databases, and critical infrastructure. Successful exploitation allows attackers to pivot from the management platform to the entire managed server fleet, potentially leading to ransomware deployment, data exfiltration, supply-chain compromise, or persistent backdoor installation.

Affected Systems: All Termix deployments running versions prior to 2.3.2. Given that Termix is positioned as a web-based management platform, deployments typically include centralized administration consoles with multiple concurrent users. The multi-tenant nature of such deployments increases the attack surface, as any low-privileged user becomes a potential threat actor. The attack specifically targets the SSH credential store, making the impact most direct for environments where Termix stores credentials for production systems.

Blast Radius: Beyond the immediate credential disclosure, the blast radius encompasses all infrastructure managed through the compromised Termix instance. Captured SSH credentials can be replayed against external-facing SSH services, enabling network-wide compromise. The scope-change component of the CVSS vector accurately reflects that the security boundary breached extends beyond the Termix application itself.

Detection Guidance

Sigma Rule

title: Termix SSH Credential Exfiltration via Host Resolution Bypass
id: 9d4e2c0d-7f4a-4a5f-9c1e-8b2f3d1a5e7c
status: experimental
description: Detects SSH connections to unusual destinations initiated by Termix backend processes, potentially indicating credential exfiltration via CVE-2026-53546.
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/node'
    CommandLine|contains|all:
      - 'ssh'
      - 'termix'
  filter_known_hosts:
    CommandLine|contains:
      - 'known_hosts'
  condition: selection and not filter_known_hosts
level: high
falsepositives:
  - Legitimate SSH connections to managed servers
  - Development environments connecting to test servers
tags:
  - attack.t1213
  - cve.2026-53546
  - cwe.639

YARA Rule

rule Termix_CVE_2026_53546_SSH_Credential_Exfil
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SSH packet capture or terminal logs indicating connections to non-standard destinations with credential material"
        cve = "CVE-2026-53546"
        date = "2026-01-15"
    strings:
        $s1 = "resolveHostById" ascii
        $s2 = "hostConfig" ascii
        $s3 = "BEGIN RSA PRIVATE KEY" ascii
        $s4 = "BEGIN OPENSSH PRIVATE KEY" ascii
        $s5 = "password" ascii nocase
        $s6 = "WebSocket" ascii
    condition:
        (uint16(0) == 0x4D5A or filesize > 100KB) and
        2 of ($s1, $s2, $s6) and
        any of ($s3, $s4, $s5)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"Termix CVE-2026-53546 SSH Credential Exfiltration Attempt"; flow:to_server,established; content:"SSH-"; offset:0; depth:4; content:"|0d 0a|"; within:10; metadata:cve CVE-2026-53546; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-53546; classtype:attempted-user; sid:202653546; rev:1;)

Elastic Detection

sequence by process.entity_id
  [process where event.action == "exec" and process.name == "node" and process.args == "ssh" and process.args == "termix"]
  [network where event.action == "connection_initiated" and destination.port == 22 and destination.ip != "10.0.0.0/8" and destination.ip != "172.16.0.0/12" and destination.ip != "192.168.0.0/16"]

Splunk SPL Query

index=main sourcetype=linux_secure OR sourcetype=process_creation
| where process_name="node" AND command_line LIKE "%ssh%" AND command_line LIKE "%termix%"
| table _time, host, user, command_line, dest_ip, dest_port
| where NOT dest_ip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
| stats count by host, user, dest_ip, dest_port
| sort -count

Wazuh OSSEC Rule

<group name="termix,">
  <rule id="100536" level="10">
    <decoded_as>json</decoded_as>
    <field name="process">node</field>
    <match>ssh</match>
    <match>termix</match>
    <description>Potential Termix SSH credential exfiltration (CVE-2026-53546) - node process initiating SSH connection</description>
    <group>cve-2026-53546,cwe-639,attack.t1213,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source was identified. The only remediation reference is the NVD description stating the issue is fixed in version 2.3.2. Organizations should verify this version is available from the vendor and validate its integrity before deployment.

Immediate Mitigations (until patched):

1. Restrict Access: Limit the number of authenticated users on the Termix platform to only those requiring administrative access. Disable accounts of users who no longer need access and review user roles to ensure least-privilege principles.
2. Network Segmentation: Place Termix behind a VPN or bastion host, restricting access to the web interface to trusted networks only. This reduces the attack surface by limiting who can reach the vulnerable WebSocket endpoint.
3. Credential Rotation: Rotate all SSH credentials stored within Termix. Given active exploitation risk, this should be done on an emergency basis — all passwords and SSH keys managed through the platform should be considered potentially compromised.
4. Monitor Authentication Logs: Enable verbose logging on all SSH servers managed via Termix. Monitor for authentication attempts originating from the Termix server IP to non-standard destinations or at unusual times.
5. Disable Credential Storage: If operationally feasible, temporarily disable the storage of SSH credentials within Termix and require manual password entry for each session. This eliminates the credential fallback target.

Patch/Upgrade Steps:

1. Monitor the official Termix distribution channels (GitHub releases, npm registry, official website) for version 2.3.2 or later.
2. Upon release validation, schedule an upgrade in a maintenance window. Back up the Termix configuration and database before upgrading.
3. After upgrading, verify that host ownership checks are enforced by testing the specific attack scenario with a test account: attempt to connect to another user's host configuration ID and confirm the request is rejected.
4. Post-upgrade, audit all stored credentials and rotate any that may have been exposed during the pre-patch window.

Long-Term Hardening:

1. Implement mandatory access control policies within Termix to enforce host configuration ownership. If not available, establish operational procedures that limit host configuration visibility to owning users only.
2. Enable multi-factor authentication for the Termix administrative interface to raise the bar for low-privilege account compromise.
3. Implement monitoring for abnormal SSH connection patterns from management servers, including outbound SSH connections to non-corporate IP addresses.
4. Ensure SSH credentials stored in management platforms are encrypted with hardware-backed keys and that the "data key" unlock mechanism has a short timeout to minimize the window during which credentials are accessible.
5. Maintain a credential inventory and enforce periodic rotation of all SSH keys and passwords stored in management platforms.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-53546
2. CWE-639 Reference: https://cwe.mitre.org/data/definitions/639.html
3. ATT&CK Technique T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
4. CVSS Calculator (v3.1) for vector verification: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
5. CISA Known Exploited Vulnerabilities Catalog (CVE not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: As of the writing of this report, no known threat actor campaigns have been publicly attributed to exploitation of CVE-2026-53546, and there is no evidence of exploitation in the wild. However, the critical severity (CVSS 9.6), low exploitation complexity, and high value of the disclosed credential material make this vulnerability an attractive target for both opportunistic and targeted threat actors, particularly those specializing in supply-chain or infrastructure compromise. Organizations should treat this as a zero-day given the patch confidence of 0/4 and the absence of an official advisory URL in available data.