CVE-2026-79758

Executive Summary

CVE-2026-79758 is a broken access control vulnerability (CWE-284) in Termix, a web-based server management platform featuring SSH terminal, tunneling, and file editing. From version 1.8.0 until 2.5.1, authenticated users can access server-stats API routes without per-host authorization, exposing host online/offline states and lastChecked timestamps, and allowing a regular user to clear the global SSH connection pool. The issue affects confidentiality of host state information and availability of SSH sessions, with a CVSS score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).

Technical Analysis

Termix is a web-based server management platform that provides SSH terminal access, tunneling, and file editing capabilities. The vulnerability resides in the src/backend/ssh/server-stats.ts routes, which implement server statistics functionality but omit per-host authorization checks.

The core flaw is CWE-284 (Improper Access Control). While the endpoints require authentication — unauthenticated requests remain blocked — authentication alone does not enforce tenant isolation or per-host authorization. This means any authenticated user, regardless of their legitimate access scope, can interact with the server-stats API.

Three specific endpoints are affected:

1. GET /status — Returns statuses for hosts the requester cannot access. This exposes host online/offline state and lastChecked timestamps across the entire deployment without filtering by the requester's authorization scope.

2. GET /status/:id — Accepts an attacker-supplied numeric host identifier. Because per-host authorization is absent, a user can supply the numeric ID of any host and retrieve its status, bypassing any logical host-scoping that should apply.

3. POST /clear-connections — Permits a regular user to clear the global SSH connection pool. This is a state-changing action that affects all users, not just the requester, and constitutes the availability-impacting vector of the vulnerability.

The affected routes leak host liveness metadata (online/offline state, lastChecked timestamps) and can disrupt other users' active sessions or pooled connections. The vulnerability is fixed in version 2.5.1.

No public proof-of-concept, exploit code, or Nuclei template is available. The attack chain described below is inferred from the vulnerability class and the NVD description.

Exploitation Scenarios

Prerequisites: The attacker must possess valid credentials for any account on a Termix instance running a vulnerable version (1.8.0 through 2.5.0). No public PoC exists; the following chain is derived from the vulnerability class (CWE-284) and the explicitly documented endpoints.

Step 1 — Reconnaissance / Target Identification: The attacker authenticates to the Termix web interface with a low-privileged account. No special privileges are required, as the flaw bypasses per-host authorization rather than elevating a principal. The attacker identifies the server-stats API by observing the application's client-side requests or by direct knowledge of the src/backend/ssh/server-stats.ts route surface.

Step 2 — Triggering the Flaw Class: The attacker issues an authenticated request to GET /status. Because the route lacks per-host authorization, the response includes statuses for hosts the requester cannot legitimately access. This leaks host online/offline state and lastChecked timestamps, enabling enumeration of the deployment's host inventory and availability patterns.

Step 3 — Payload / Execution Method at the Vulnerability-Class Level: To enumerate a specific host, the attacker sends GET /status/:id with attacker-supplied numeric host identifiers. The route accepts the numeric identifier and returns the corresponding host's status without verifying that the requester is authorized for that host. There is no injection or memory-corruption primitive here — the attack is purely a missing-authorization-check bypass.

Step 4 — Post-Exploitation Impact: Using the same authenticated session, the attacker sends POST /clear-connections. This clears the global SSH connection pool, disrupting other users' active sessions and pooled connections across the deployment. The attacker gains:

• Confidentiality impact: host liveness state and lastChecked timestamps for unauthorized hosts.
• Availability impact: disruption of other users' SSH sessions and pooled connections via the global clear operation.

Because the POST /clear-connections action is global, a single low-privileged authenticated user can repeatedly disrupt operations, and the reconnaissance phase can map the full host estate before or alongside disruption.

Impact Assessment

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L yields a base score of 5.4 (Medium). Subscores:

• Confidentiality (C:L): Low. Host online/offline state and lastChecked timestamps for unauthorized hosts are exposed. This is metadata, not host content, but it reveals infrastructure layout and availability.
• Integrity (I:N): None. The vulnerability does not modify host data or configuration.
• Availability (A:L): Low. POST /clear-connections can disrupt other users' active sessions and pooled connections, but does not permanently disable the platform.
• Attack Vector (AV:N): Network — exploitable remotely over the web interface.
• Attack Complexity (AC:L): Low — the endpoints are directly reachable by any authenticated user.
• Privileges Required (PR:L): Low — any valid Termix account suffices.
• User Interaction (UI:N): None — no victim action required.
• Scope (S:U): Unchanged — impact remains within the Termix security authority.

Business impact: In multi-tenant or shared Termix deployments, the loss of tenant isolation means one customer or team can observe and disrupt another's hosts. Host liveness metadata can support lateral-movement planning by revealing which hosts are online. Session-pool clearing causes operational disruption and may interrupt active administrative work, creating a denial-of-service window. The blast radius is the entire Termix deployment, since GET /status and POST /clear-connections are global in scope.

Detection Guidance

Sigma Rule

title: Termix Server-Stats Unauthorized Host Access (CVE-2026-79758)
id: 3f9a1c2e-7b4d-4e5f-9a1b-2c3d4e5f6a7b
status: experimental
description: Detects access to Termix server-stats endpoints where the requester may lack per-host authorization, indicative of CVE-2026-79758 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79758
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: termix
detection:
  selection_status:
    cs-method: 'GET'
    cs-uri-stem:
      - '/status'
      - '/status/*'
  selection_clear:
    cs-method: 'POST'
    cs-uri-stem: '/clear-connections'
  condition: selection_status or selection_clear
falsepositives:
  - Legitimate administrative dashboard polling from authorized users
level: medium
tags:
  - attack.t1078
  - cve.2026-79758

YARA Rule

rule CVE_2026_79758_Termix_Server_Stats_Access
{
    meta:
        description = "Detects Termix server-stats endpoint references indicative of CVE-2026-79758"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79758"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $route1 = "/clear-connections" ascii wide
        $route2 = "/status" ascii wide
        $host1 = "server-stats" ascii wide
        $host2 = "lastChecked" ascii wide

    condition:
        ($route1 and $route2) or ($host1 and ($route1 or $route2)) or ($host2 and $route2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-79758 Termix Unauthorized Server-Stats Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/status"; http.uri; pcre:"/^\/status(\/\d+)?$/"; sid:202679758; rev:1; metadata:reference nvd,cve,2026-79758; classtype:attempted-recon;)

alert http any any -> any any (msg:"CVE-2026-79758 Termix Global Connection Pool Clear Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/clear-connections"; sid:202679759; rev:1; metadata:reference nvd,cve,2026-79758; classtype:attempted-dos;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where http.request.method == "GET" and
      http.request.path : ("/status", "/status/*") and
      event.category == "network" ]
  [ network where http.request.method == "POST" and
      http.request.path == "/clear-connections" and
      event.category == "network" ]

Splunk SPL Query

index=web sourcetype=termix OR sourcetype=access_combined
| eval method=upper(coalesce(http_method, cs_method, method))
| eval uri=coalesce(uri_path, cs_uri_stem, url)
| where (method="GET" AND (uri="/status" OR like(uri, "/status/%")))
        OR (method="POST" AND uri="/clear-connections")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as endpoints values(method) as methods
        by src_ip user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="termix,web,cve-2026-79758,">
  <rule id="2026797" level="7">
    <decoded_as>json</decoded_as>
    <field name="http_method">GET</field>
    <regex field="uri_path">^/status(/[0-9]+)?$</regex>
    <description>CVE-2026-79758: Termix server-stats access - possible unauthorized host status query</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
  <rule id="2026798" level="10">
    <decoded_as>json</decoded_as>
    <field name="http_method">POST</field>
    <field name="uri_path">/clear-connections</field>
    <description>CVE-2026-79758: Termix global SSH connection pool clear - possible denial of service</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

1) Immediate mitigations:

• Upgrade to Termix version 2.5.1 or later. Although no vendor patch source is tracked in this dataset, the NVD description states the issue is fixed in 2.5.1.
• Until upgrade is possible, restrict network access to Termix to trusted networks or place it behind an authenticating reverse proxy that enforces per-user host scoping.
• Where feasible, disable or block the server-stats endpoints (GET /status, GET /status/:id, POST /clear-connections) at the proxy/WAF layer for non-administrative users.
• Audit Termix user accounts and enforce least privilege; the vulnerability lowers the bar for any authenticated user, so reducing the number of valid low-privileged accounts limits exposure.
• Monitor for anomalous access to the server-stats routes and for repeated POST /clear-connections calls from non-administrative accounts.

2) Patch/upgrade steps:

• Verify the exact Termix release currently deployed (versions 1.8.0 through 2.5.0 are affected per the NVD description).
• Back up Termix configuration and data.
• Deploy version 2.5.1, which the NVD description states contains the fix.
• Validate that per-host authorization is enforced on the server-stats routes after upgrade by testing with a low-privileged account against a host it should not access.

3) Long-term hardening:

• Implement centralized, server-side authorization checks on every route that returns host-scoped data, enforcing tenant isolation independent of authentication.
• Apply the principle of least privilege to state-changing operations; global actions such as clearing the connection pool should require elevated privileges.
• Add regression tests asserting that users cannot access hosts outside their authorization scope.
• Adopt a documented vulnerability management cadence to reduce the window between affected-version disclosure and upgrade.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-79758
• CWE-284: Improper Access Control — https://cwe.mitre.org/data/definitions/284.html
• MITRE ATT&CK T1078: Valid Accounts — https://attack.mitre.org/techniques/T1078/
• FIRST EPSS: Not yet scored — https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog: Not listed as of this report — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-79758 at the time of writing. No public PoC, exploit code, or Nuclei template was identified; CISA KEV status is NO.