CVE-2026-53548

Executive Summary

CVE-2026-53548 is a critical broken access control vulnerability in Termix, a web-based server management platform offering SSH terminal, tunneling, and file editing capabilities. Prior to version 2.6.1, any authenticated user possessing a valid JWT can enumerate sequential numeric host IDs and retrieve plaintext SSH or sudo passwords belonging to other users by exploiting a missing host ownership check in the credential resolution endpoint. This flaw enables lateral movement and full compromise of managed systems outside the Termix instance, carrying a CVSS 3.1 base score of 9.6 (Critical) due to network accessibility, low attack complexity, low privilege requirements, and severe confidentiality and integrity impact with scope change. No public exploit is currently known, and no patch evidence has been observed from tracked sources beyond the vendor's fixed release version 2.6.1.

Technical Analysis

The vulnerability resides in the endpoint GET /host/db/host/:id/password within the file src/backend/database/routes/host.ts in Termix versions prior to 2.6.1. The endpoint accepts an authenticated user's numeric host ID via the URL path parameter :id and an optional field=password or field=sudoPassword query parameter to select which credential type to resolve.

The root cause is a missing authorization check: the endpoint does not enforce host ownership during credential resolution. In a correctly designed system, when a user requests a password for a host ID, the application should first verify that the authenticated user is the owner of that host before resolving and returning the credential. Instead, the flawed implementation attempts a requester-scoped lookup (i.e., a database query restricted to hosts owned by the requesting user). When this scoped lookup fails to find a match, the application falls back to resolving the host using the owner's context — effectively bypassing the ownership restriction.

This fallback behavior allows a failed requester-scoped lookup to resolve the host record with the actual owner's context, and subsequently return the owner's plaintext credential to the requesting user. Because host IDs are sequential integers (hosts.id), an attacker can trivially enumerate valid IDs by iterating through numeric values (e.g., 1, 2, 3, ...) in the URL path and issuing requests for each ID.

The vulnerability is classified as CWE-285 (Improper Authorization), indicating that the application fails to enforce proper access restrictions on this specific resource. The attack surface is the HTTP API layer — the endpoint is network-accessible, requires only a valid JWT (low privilege), and does not require user interaction. Successful exploitation yields plaintext SSH passwords or sudo passwords for arbitrary managed hosts, which can then be used to access and control systems that are managed through the Termix platform.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N reflects: network attack vector, low attack complexity, low privileges required, no user interaction, scope change (the compromised credentials allow access to systems outside the Termix instance itself), high confidentiality impact (credential disclosure), high integrity impact (ability to modify managed systems), and no availability impact.

No specific technical details are available regarding the exact implementation of the scoped lookup fallback, but the described behavior establishes the vulnerability class as an improper authorization flaw with an unsafe fallback mechanism.

Exploitation Scenarios

The attack chain for CVE-2026-53548 is as follows. Note: No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description.

Step 1 — Reconnaissance/Target Identification: The attacker requires a valid JWT for the Termix instance. This can be obtained by registering a legitimate account on the platform (if self-registration is enabled) or by compromising any low-privileged account. Once authenticated, the attacker identifies the vulnerable endpoint format GET /host/db/host/:id/password and notes that host IDs are sequential integers (based on the hosts.id field).

Step 2 — Triggering the Authorization Bypass: The attacker begins issuing authenticated GET requests to the endpoint with sequential host IDs. For each request, the attacker includes the field=password query parameter. For host IDs that belong to other users, the requester-scoped lookup will fail (since the host is not owned by the attacker), triggering the vulnerable fallback path that resolves the host with the owner's context.

Step 3 — Payload/Execution at Vulnerability-Class Level: The attack is a pure authorization bypass — no injection payload is required. The attacker simply supplies a numeric host ID in the URL and a field=password (or field=sudoPassword) query parameter. The application's improper authorization logic returns the owner's plaintext credential in the HTTP response body. This is an IDOR (Insecure Direct Object Reference) variant combined with a broken access control fallback.

Step 4 — Post-Exploitation Impact: With the retrieved SSH or sudo passwords, the attacker can authenticate directly to the managed systems (servers, hosts) that Termix manages. This grants the attacker full control over those systems — enabling data exfiltration, malware deployment, ransomware execution, or further lateral movement within the target environment. Because the compromised credentials are for the underlying managed infrastructure (not just the Termix web app), the integrity impact extends beyond the Termix instance itself, which is reflected in the scope change (S:C) component of the CVSS score.

Alternative Scenario — Mass Credential Harvesting: An attacker can automate enumeration of all host IDs (e.g., 1 through N) in a loop, harvesting every user's SSH/sudo passwords in a single automated campaign. This would grant the attacker a complete credential repository for all systems managed by the Termix instance in a matter of minutes.

Impact Assessment

Business Impact: This vulnerability constitutes a critical breach of tenant isolation and credential confidentiality in a centralized server management platform. Organizations using Termix for SSH access, tunneling, and file editing are at risk of complete compromise of their managed infrastructure. Attackers can harvest all managed system credentials, enabling full remote control of servers. The confidentiality impact is rated High (C:H), and the integrity impact is rated High (I:H).

Affected Systems: All Termix deployments running versions prior to 2.6.1 are vulnerable. This includes any organization that self-hosts Termix as a centralized SSH management and file editing platform.

Blast Radius: The scope change component (S:C) in the CVSS vector indicates that the impact extends beyond the vulnerable component (the Termix application) to other resources — specifically, all systems managed through Termix. If an organization manages a large fleet of servers through Termix, the blast radius includes every one of those systems. Credential reuse further amplifies the risk: if users reuse their sudo/SSH passwords elsewhere, the attacker may gain access to unrelated systems.

CVSS Subscores: The base score of 9.6 (Critical) is driven by: AV:N (network exploitable), AC:L (no special conditions required), PR:L (only low privileges needed — any authenticated user), UI:N (no user interaction), S:C (scope change — impact on managed systems), C:H (high confidentiality impact — plaintext credential disclosure), I:H (high integrity impact — full control of managed systems), A:N (no availability impact).

CISA KEV Status: Not listed on CISA's Known Exploited Vulnerabilities catalog at the time of this report. However, the absence from KEV does not indicate absence of exploitation; it only indicates CISA has not confirmed in-the-wild exploitation.

Detection Guidance

Sigma Rule

title: Termix Password Endpoint Authorization Bypass Attempt
id: 7f3c9a51-2b44-4a6e-8e92-1c5a3f4b2d88
status: experimental
description: Detects enumeration attempts against the Termix host password endpoint, indicating possible exploitation of CVE-2026-53548.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-53548
author: vultersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: GET
    cs-uri-path|contains:
      - '/host/db/host/'
      - '/password'
    cs-uri-query|contains:
      - 'field=password'
      - 'field=sudoPassword'
  filter_normal:
    cs-username|endswith: '@admin'
    cs-uri-path|contains: '/host/db/host/1/'
  condition: selection and not filter_normal
falsepositives:
  - Legitimate administrative access to own host password
  - Monitoring probes
level: high

YARA Rule

rule Termix_CVE_2026_53548_Authorization_Bypass
{
    meta:
        author = "vultersit.com Threat Intelligence"
        description = "Detects patterns associated with CVE-2026-53548 exploitation in Termix web logs"
        cve = "CVE-2026-53548"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $s1 = "/host/db/host/" ascii wide
        $s2 = "password" ascii wide
        $s3 = "field=password" ascii wide
        $s4 = "field=sudoPassword" ascii wide
        $s5 = "hosts.id" ascii wide
        $s6 = "GET /host/db/host/" ascii wide
    condition:
        uint16(0) == 0x0D0A and any of ($s1, $s6) and any of ($s2, $s3, $s4)
}

Note: This YARA rule targets HTTP request logging artifacts (access logs, proxy captures) for forensic hunting.

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Termix CVE-2026-53548 Host Password Enumeration Attempt";
    flow:established,to_server;
    http.method; content:"GET";
    http.uri; content:"/host/db/host/";
    http.uri; content:"/password";
    http.uri; pcre:"/\/password\?field=(password|sudoPassword)/i";
    http.header; content:"Authorization";
    classtype:attempted-admin;
    reference:cve,2026-53548;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-53548;
    sid:202653548;
    rev:1;
    metadata:created_at 2026-01-01, updated_at 2026-01-01;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "GET" and
   startsWith(http.request.uri.path, "/host/db/host/") and
   endsWith(http.request.uri.path, "/password") and
   (http.request.uri.query contains "field=password" or
    http.request.uri.query contains "field=sudoPassword")]
  | head 20
  [http where http.request.method == "GET" and
   startsWith(http.request.uri.path, "/host/db/host/") and
   endsWith(http.request.uri.path, "/password") and
   (http.request.uri.query contains "field=password" or
    http.request.uri.query contains "field=sudoPassword")]

Note: This EQL sequence detects rapid successive requests to the vulnerable endpoint from a single source IP — a hallmark of host ID enumeration. Adjust the head 20 threshold based on observed legitimate traffic patterns.

Splunk SPL Query

index=web sourcetype=access_combined
| where method="GET" AND match(uri_path, "(?i)/host/db/host/\d+/password")
| where match(uri_query, "(?i)field=(password|sudoPassword)")
| stats count by src_ip, uri_path, uri_query
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="termix,">
  <rule id="100541" level="10" frequency="8" timeframe="60">
    <if_sid>31122</if_sid>
    <match>GET /host/db/host/</match>
    <regex>\/password\?field=(password|sudoPassword)</regex>
    <description>Termix CVE-2026-53548: Multiple host password enumeration requests detected from $(srcip)</description>
    <group>attack,authentication_failures,termix</group>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Note: if_sid should reference your existing web server access log rule. Adjust frequency and timeframe to reduce false positives in high-traffic environments.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source). The vendor has released version 2.6.1 to address this issue, but no formal patch advisory, changelog, or CVE-mapped patch metadata has been observed in tracked sources at the time of this report.

Immediate Mitigations (do these first)

1. Upgrade to Termix 2.6.1 immediately if available. The fix is confirmed to be included in this version per the NVD description.
2. Restrict access to the vulnerable endpoint at the reverse proxy / WAF layer. Block or heavily restrict external access to GET /host/db/host/*/password* and require all requests to originate from trusted internal networks.
3. Disable or rotate all SSH and sudo passwords managed through Termix. Since credentials may have already been exfiltrated, rotate secrets for all hosts managed by the platform.
4. Enable multi-factor authentication (MFA) for all Termix user accounts and for SSH access to managed hosts, if not already enabled. This reduces the value of stolen passwords.
5. Monitor access logs for abnormal enumeration patterns — specifically, repeated requests to the vulnerable endpoint across sequential host IDs from the same authenticated user or source IP.

Patch/Upgrade Steps

• Upgrade all Termix instances to version 2.6.1 or later.
• After upgrading, perform a credential rotation for all managed hosts as a precautionary measure, since prior exposure cannot be ruled out.
• Verify the upgrade by testing the endpoint with a non-owner account and confirming that ownership restrictions are now enforced (i.e., a user should not be able to retrieve passwords for hosts they do not own).

Long-Term Hardening

1. Adopt zero-trust principles for the Termix instance: ensure no host on the platform is directly reachable from the internet; put the platform behind a VPN or bastion host.
2. Replace plaintext credential storage in favor of per-session, on-demand credential issuance (e.g., SSH certificates, short-lived credentials, or vault-backed secret injection).
3. Enforce strict host ownership checks at the application layer as a development standard — audit all API endpoints that accept object IDs to verify they enforce authorization before returning sensitive data.
4. Implement rate limiting on the vulnerable endpoint and similar credential-returning endpoints to slow down enumeration attacks.
5. Enable comprehensive audit logging for all credential access attempts, including successful authentications, and correlate with host ownership data.
6. Regularly assess the vendor's release channel for the official 2.6.1 security advisory and subscribe to notifications for future security updates.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-53548
2. Exploit-DB / GitHub Advisory: No public advisory observed at report time — vendor channel TBD. Monitor https://github.com/Termix (project repository) for the 2.6.1 release notes.
3. CWE-285 Reference: https://cwe.mitre.org/data/definitions/285.html
4. MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/

Threat Actor / In-the-Wild Evidence: No known campaigns or exploit activity observed at report time. CISA KEV status: NOT listed. EPSS score: Not yet scored by FIRST.org. PoC/Exploit status: NONE publicly available.

Disclaimer: Patch confidence is rated 0/4 (UNPATCHED from tracked patch sources). Organizations should independently verify the availability of Termix 2.6.1 via their vendor channels before scheduling upgrades.