CVE-2026-79759

Executive Summary

CVE-2026-79759 is an authorization bypass vulnerability in Termix, a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From version 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint fails to verify that credential and target-host records belong to the requesting user, allowing an authenticated attacker to access and potentially deploy credentials to unauthorized hosts. While encrypted passwords and keys are not disclosed, the vulnerability enables differential error analysis to enumerate credential and host records, and permits outbound SSH connection attempts to victim hosts using the attacker's public key.

Technical Analysis

The vulnerability resides in the POST /credentials/:id/deploy-to-host endpoint, which processes attacker-controlled credentialId and targetHostId integer values. The core flaw, classified as CWE-639 (Authorization Bypass Through User-Controlled Key), is the absence of ownership validation when resolving credential and target-host records from the database. In src/backend/database/routes/credentials.ts, the application retrieves records based solely on the provided IDs without confirming that these records belong to the requesting user's session or account context.

This creates an insecure direct object reference (IDOR) condition where any authenticated user can reference credentials and hosts belonging to other users. The endpoint's error handling exacerbates the issue by returning differential error responses that reveal whether specific credential and host records exist. Furthermore, the error messages disclose each record's authType value, providing attackers with reconnaissance data about authentication mechanisms in use.

The impact is partially constrained because properly encrypted passwords and keys are not directly disclosed through this endpoint. However, the vulnerability enables a key-authenticated victim host to receive an outbound SSH connection attempt using the attacker's public key. This occurs when an attacker manipulates the credentialId and targetHostId parameters to reference another user's host record, causing the system to initiate an SSH connection to that host with the attacker's supplied authentication material.

The attack surface is significant because Termix is designed to manage SSH connections, tunneling, and file editing across multiple servers. By exploiting this authorization bypass, an attacker can leverage the platform's legitimate functionality to establish unauthorized connections to hosts they should not have access to.

Exploitation Scenarios

1. Reconnaissance/target identification: An attacker with valid credentials to a Termix instance identifies the platform version (between 1.7.0 and 2.5.0). They enumerate the /credentials/:id/deploy-to-host endpoint and observe that credentialId and targetHostId parameters are integers that may be sequentially guessable or enumerable.

2. How the specific flaw class is triggered: The attacker sends POST requests to /credentials/:id/deploy-to-host with various credentialId and targetHostId values. The endpoint resolves these records without verifying user ownership. Differential error responses reveal whether records exist and disclose authType values for valid records. This is an authorization bypass through user-controlled key (CWE-639) where the attacker manipulates object references to access unauthorized resources.

3. Payload/execution method at the vulnerability-class level: No public PoC is available; the attack chain is inferred from the vulnerability class. The attacker crafts HTTP POST requests with manipulated integer parameters to reference other users' credential and host records. Because the endpoint initiates SSH connection attempts based on these references, the attacker can cause an outbound SSH connection to a victim host using the attacker's public key when the target host is configured for key-based authentication.

4. Post-exploitation impact: The attacker achieves low-confidentiality impact by enumerating credential and host records through differential errors, learning authType values, and potentially establishing unauthorized SSH connections to victim hosts. While encrypted secrets are not directly exposed, the unauthorized connection attempts may enable further attacks if the victim host accepts the attacker's key or if the connection attempt reveals additional information.

Impact Assessment

The CVSS v3.1 score is 4.3 (Medium), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. This reflects network-based exploitation requiring low privileges and no user interaction, with low confidentiality impact and no integrity or availability impact. The scope is unchanged, meaning the vulnerability affects only the vulnerable Termix component and not other systems.

Business impact includes unauthorized access to credential and host metadata, potential reconnaissance of authentication mechanisms, and the ability to initiate SSH connections to victim hosts. The blast radius is limited to Termix instances running versions 1.7.0 through 2.5.0 that have multiple users with distinct credential and host configurations. Organizations using Termix for centralized server management may face risks of lateral movement or unauthorized access if an attacker can leverage the outbound SSH connection capability.

Detection Guidance

Sigma Rule

title: Termix Unauthorized Credential Deployment Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2026-79759 by accessing the deploy-to-host endpoint with potentially unauthorized credential and host IDs
author: Security Team
date: 2026-01-01
logsource:
  category: webserver
  product: termix
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|startswith: '/credentials/'
    cs-uri-stem|endswith: '/deploy-to-host'
  condition: selection
falsepositives:
  - Legitimate administrative activity
level: medium
tags:
  - attack.t1213
  - cve.2026.79759

YARA Rule

rule CVE_2026_79759_Termix_Authorization_Bypass
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-79759 in Termix"
        author = "Security Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79759"
        severity = "medium"

    strings:
        $endpoint = "/credentials/"
        $deploy = "/deploy-to-host"
        $credid = "credentialId"
        $hostid = "targetHostId"

    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-79759 Termix Authorization Bypass Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/credentials/"; http_uri; content:"/deploy-to-host"; http_uri; content:"credentialId"; http_client_body; content:"targetHostId"; http_client_body; reference:cve,2026-79759; classtype:attempted-user; sid:202679759; rev:1;)

Elastic Detection

network where http.request.method == "POST" and
  startsWith(http.request.uri.path, "/credentials/") and
  endsWith(http.request.uri.path, "/deploy-to-host") and
  http.request.body contains "credentialId" and
  http.request.body contains "targetHostId"

Splunk SPL Query

index=web sourcetype=access_combined
method=POST
uri_path="/credentials/*/deploy-to-host"
| rex field=uri_path "/credentials/(?<credential_id>\d+)/deploy-to-host"
| stats count by src_ip, credential_id, status
| where count > 5

Wazuh OSSEC Rule

<group name="termix,cve-2026-79759,">
  <rule id="100797" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.method">POST</field>
    <field name="http.url" type="pcre2">^/credentials/\d+/deploy-to-host$</field>
    <description>CVE-2026-79759: Termix unauthorized credential deployment attempt detected</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict access to the Termix web interface to trusted networks or VPNs.
• Implement network-level controls to block or monitor POST requests to /credentials/:id/deploy-to-host.
• Enforce strict user account management and least-privilege principles for Termix users.
• Monitor logs for anomalous access patterns to the deploy-to-host endpoint, particularly with sequential or unusual credentialId/targetHostId values.

2. Patch/upgrade steps:

• Upgrade Termix to version 2.5.1 or later, which contains the fix for this vulnerability.
• If immediate upgrade is not possible, consider temporarily disabling the deploy-to-host functionality if it is not essential.
• After upgrading, verify that the endpoint properly validates record ownership.

3. Long-term hardening:

• Implement comprehensive authorization checks for all endpoints that resolve user-controlled object references.
• Adopt secure coding practices that enforce ownership validation at the data access layer.
• Conduct regular security assessments and penetration testing focused on IDOR and authorization bypass vulnerabilities.
• Implement centralized logging and monitoring for all credential and host management operations.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-79759
• Termix Project Repository: https://github.com/termix/termix (returned 404 — verify manually) (inferred from product name)
• CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• No known threat actor campaigns or exploit-in-the-wild evidence for CVE-2026-79759 at this time.