CVE-2026-79760

Executive Summary

CVE-2026-79760 is a server-side request forgery (SSRF) vulnerability in Termix, a web-based server management platform offering SSH terminal, tunneling, and file editing. In versions 2.5.0 through 2.5.0 (fixed in 2.5.1), any authenticated user can configure webhook or ntfy notification channels with attacker-controlled URLs and trigger server-side requests via the notification-channel test endpoint, which lacks destination allowlisting and private-address blocking. The primary impact is blind SSRF against internal HTTP services reachable by the Termix server; webhook mode additionally allows attacker-controlled HTTP methods and headers that may cause limited state changes. CVSS 3.1 base score is 6.4 (Medium).

Technical Analysis

Termix exposes a notification-channel configuration workflow that permits authenticated users to supply arbitrary destination URLs for webhook and ntfy delivery. The request path is described as originating in src/backend/database/routes/alert-rules-routes.ts and reaching src/backend/utils/notification-sender.ts. According to the NVD description, this path performs no destination allowlisting and no private-address blocking. As a result, the Termix server will issue outbound HTTP requests to whatever host is supplied — including loopback, link-local, RFC 1918, or other internal-only addresses reachable from the server's network position.

The vulnerability class is CWE-918 (Server-Side Request Forgery). The attack is "blind" in the sense that server response bodies are not returned to the requesting user; however, success/failure signals from the notification-channel test endpoint can be abused as an oracle to probe internal service reachability. In webhook mode, the description further states that attacker-controlled HTTP methods and headers are permitted, meaning the request is not constrained to a fixed verb or header set. This raises the impact beyond pure reachability testing: if an internal service accepts the fixed notification body, an attacker can drive limited state changes by selecting the method and headers. The fixed notification body itself is not user-tunable, which bounds the achievable request semantics.

No code-level detail beyond the two named files and the described behavior is available from the source data. No public proof-of-concept, exploit code, or Nuclei template was identified at time of writing. Note also that the CVSS vector reflects network attack vector (AV:N), low privileges (PR:L, consistent with an authenticated user), no user interaction (UI:N), and scope change (S:C), with limited integrity (I:L) and availability (A:L) impact and no confidentiality (C:N) impact — the latter consistent with the blind nature of the SSRF (no response bodies returned).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description only. No function names, parameters, or endpoints beyond those quoted from the description are asserted.

1. Reconnaissance / target identification. The attacker requires an authenticated Termix account. Termix instances are typically internet-exposed management platforms, so the attacker (or a malicious/compromised low-privilege user) identifies an instance and obtains a session. There is no unauthenticated path described.

2. Triggering the flaw class. Using the notification-channel configuration interface, the attacker adds a webhook or ntfy channel whose destination URL points at an internal target — e.g., http://127.0.0.1:<port>/, a link-local address, or an RFC 1918 host on the same segment as the Termix server. The notification-channel test endpoint is then invoked, causing the backend to call src/backend/utils/notification-sender.ts and dispatch the request to the attacker-chosen destination without allowlist or private-address checks.

3. Payload / execution method. For ntfy and basic webhook use, the attacker controls the URL only. In webhook mode, the description states the attacker may also control the HTTP method and headers, permitting requests such as method-switched verbs against internal services. The request body is the fixed notification payload and is not attacker-controlled, so injection into internal APIs via body content is limited. The response body is not returned to the caller, making this a blind SSRF.

4. Post-exploitation impact. The attacker uses the instance as a request proxy into the internal network: enumerating reachable services and ports via differing test-endpoint outcomes, and — where internal services accept the fixed body with the chosen method/headers — inducing limited state changes. Because scope changes (S:C), the vulnerability impacts components beyond the vulnerable Termix instance. Confidentiality impact is scored None, reflecting the absence of response-body disclosure, though side channels (timing, status) may still leak reachability information.

Impact Assessment

CVSS 3.1 base score 6.4 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L. The network attack vector and low privilege requirement mean any authenticated user of the platform can exploit it; no user interaction is required. The scope-change subscore reflects that exploitation affects resources beyond the vulnerable component — namely internal HTTP services. Integrity and availability are each rated Low: limited state changes are possible in webhook mode when an internal service accepts the fixed body, and internal service disruption remains bounded. Confidentiality is rated None because response bodies are not returned.

Business impact centers on network boundary erosion: a Termix server positioned with access to internal management planes becomes an authenticated SSRF pivot. Blast radius includes any HTTP service reachable from the Termix host — internal admin panels, metadata endpoints, service APIs — subject to the fixed-body constraint. Affected systems are Termix deployments pinned to 2.5.0.

Detection Guidance

Sigma Rule

title: Potential Termix Notification Channel SSRF via Test Endpoint
id: 8f2c1a44-7b90-4d2e-9c11-termix79760
status: experimental
description: Detects outbound requests from Termix to private/loopback destinations triggered by the notification-channel test endpoint (CVE-2026-79760).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79760
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: network_connection
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/node'
    CommandLine|contains:
      - 'notification-sender'
  selection_dest:
    DestinationIp|cidr:
      - '127.0.0.0/8'
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '169.254.0.0/16'
  condition: selection_proc and selection_dest
falsepositives:
  - Legitimate internal notification integrations configured by administrators
level: medium

YARA Rule

rule CVE_2026_79760_Termix_SSRF_Indicators
{
    meta:
        description = "Detects Termix source/config artifacts associated with CVE-2026-79760 SSRF in notification channel handling"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79760"
        cve = "CVE-2026-79760"
        author = "Threat Intelligence"
        date = "2026-01-01"
    strings:
        $p1 = "notification-sender" ascii
        $p2 = "alert-rules-routes" ascii
        $p3 = "ntfy" ascii nocase
        $p4 = "notification-channel" ascii nocase
        $p5 = "webhook" ascii nocase
    condition:
        filesize < 5MB and any of ($p*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-79760 Termix notification test endpoint SSRF attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"notification"; http.uri; content:"test"; http.header; content:"X-Forwarded-For"; classtype:attempted-recon; sid:7976001; rev:1; metadata:cve CVE-2026-79760;)

Elastic Detection

network where process.name == "node" and
  destination.ip in ("127.0.0.1","::1") and
  url.path : "notification*"

Splunk SPL Query

index=proxy OR index=network
| search (process_name="node" OR app="termix")
| where match(dest_ip, "^(127\.|10\.|192\.168\.|169\.254\.|172\.(1[6-9]|2[0-9]|3[01])\.)")
| table _time host process_name dest_ip dest_port url
| sort - _time

Wazuh OSSEC Rule

<group name="termix,ssrf,">
  <rule id="100760" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">notification</field>
    <field name="dest_ip">127.0.0.1</field>
    <description>CVE-2026-79760: Possible Termix notification-channel SSRF to loopback</description>
  </rule>
  <rule id="100761" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">notification</field>
    <field name="dest_ip">^10\.</field>
    <description>CVE-2026-79760: Possible Termix notification-channel SSRF to private range</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Restrict authenticated access to Termix; audit accounts that can configure notification channels.
• Egress-filter the Termix server so it cannot reach loopback, link-local (169.254.0.0/16), or RFC 1918 destinations except where explicitly required.
• Disable or gate notification-channel creation and testing until upgrade is possible.
• Monitor notification-sender process egress for internal-destination requests (see detection rules).

2. Patch/upgrade steps

• Upgrade to Termix 2.5.1, which the NVD description states fixes the issue. No independent patch source has confirmed this, so verify the fix in your environment.

3. Long-term hardening

• Enforce destination allowlisting and private-address blocklisting in the notification dispatch path.
• Restrict attacker-controlled HTTP methods and headers on notification requests.
• Apply least-privilege network segmentation so management platforms cannot reach internal service APIs beyond their function.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-79760
• CWE-918: Server-Side Request Forgery — https://cwe.mitre.org/data/definitions/918.html
• FIRST EPSS — not yet scored for this CVE
• CISA KEV — not listed
• No known threat actor campaigns or exploit-in-the-wild evidence identified; no public PoC, exploit code, or Nuclei template available.