CVE-2026-79761

Executive Summary

CVE-2026-79761 is an authenticated OS command injection vulnerability (CWE-78) in Termix, a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. From version 1.7.0 until 2.5.1, the SSH key deployment flow derives a grep pattern (keyPattern) from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on a selected remote target host. Any authenticated user able to deploy a crafted SSH credential can execute arbitrary commands with the privileges of the selected remote account, potentially pivoting from the management platform into managed infrastructure.

Technical Analysis

Termix is a web-based server management platform that brokers SSH sessions, tunneling, and remote file editing to managed hosts. The vulnerable component is the SSH key deployment workflow implemented in src/backend/database/routes/credential-deploy-routes.ts. According to the NVD description, this flow derives a grep pattern from a user-controlled public-key token and interpolates that value — referred to as keyPattern — directly into double-quoted shell commands that are executed on the selected target host.

The core defect is the classic CWE-78 pattern: untrusted input (a public-key token supplied during credential deployment) is treated as a shell fragment rather than as an opaque string. Because the interpolation occurs inside double-quoted shell commands, two distinct injection primitives are available to an attacker who controls the token:

1. Command substitution — within double quotes, shell syntax such as $(...) or backticks is still evaluated by the shell. A token containing command substitution therefore causes the embedded command to run on the remote host as part of the grep -F verification step.
2. Quote-breaking syntax — by embedding quote characters in the token, the attacker can terminate the intended double-quoted context and append arbitrary additional shell commands that execute after (or instead of) the intended grep invocation.

Both grep -F verification paths in the route file are reported as accepting this malicious syntax, meaning the injection surface is not limited to a single code branch. The use of grep -F (fixed-string matching) does not mitigate the flaw: -F only affects how grep interprets its pattern argument. The shell parses and expands the command line — including command substitution and quote termination — before grep ever receives the argument, so -F provides no protection against this injection class.

Attack surface: the flaw is reachable through the authenticated Termix web interface, specifically the SSH key/credential deployment function. Because the crafted command is executed on the selected remote target host using that host's selected account, the vulnerability crosses a trust boundary (reflected in the CVSS scope change of S:C) — compromising the Termix application is not a prerequisite; the impact lands on downstream managed systems.

Preconditions:

• Valid authenticated access to the Termix platform with permission to deploy SSH credentials.
• Ability to select or supply a target host and account for credential deployment.
• Ability to influence the public-key token that becomes keyPattern.

The NVD description explicitly notes that a separate ACME command-injection report is outside the scope of this CVE; analysts should not conflate the two issues.

No public PoC, exploit code, or Nuclei template is available for this CVE, and it is not listed in CISA KEV. The exact character sequence that survives the application's own input handling and reaches the shell is not specified in the available data; the attack chain below is therefore described at the vulnerability-class level.

Exploitation Scenarios

No public PoC is available. The following chain is inferred from the vulnerability class (CWE-78, shell command injection via double-quoted interpolation) and the NVD description.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Termix instance (versions 1.7.0 through 2.5.0). With valid credentials — obtained legitimately, through credential reuse, or via prior compromise of a low-privileged account — the attacker maps the managed hosts and accounts available through the credential deployment function.

2. Triggering the flaw. The attacker initiates an SSH key deployment to a selected target host and supplies a crafted public-key token. The Termix backend derives keyPattern from this token in src/backend/database/routes/credential-deploy-routes.ts and interpolates it into a double-quoted grep -F command executed on the target host. Because the value is user-controlled and not safely escaped or quoted, the attacker's embedded shell syntax is evaluated.

3. Payload / execution method (class level). The attacker embeds either shell command substitution ($(...) / backticks) or quote-breaking characters plus trailing shell commands in the token. When the remote command is executed, the injected content runs with the privileges of the selected remote account. No specific payload string is documented in available sources; exploitation depends on crafting a token that survives the application's handling and reaches the shell unescaped.

4. Post-exploitation impact. Successful injection yields command execution on the remote managed host, not merely on the Termix server (scope change). From that foothold the attacker can read or exfiltrate data, establish persistence (e.g., via authorized_keys manipulation, which is thematically adjacent to the abused feature), move laterally within the managed environment, or use the host as a pivot. Confidentiality, integrity, and availability impacts are each rated Low in the CVSS vector, consistent with constrained but real command-execution capability under the privileges of the selected remote account.

Impact Assessment

The CVSS 3.1 base score is 6.6 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L:

• AV:N (Network): the Termix web interface is reachable over the network.
• AC:L (Low): no special conditions beyond supplying a crafted token.
• PR:H (High): requires authenticated access with credential-deployment privileges.
• UI:N (None): no victim interaction required.
• S:C (Changed): the exploited component (Termix backend) and the impacted component (the remote target host) differ — a key severity driver.
• C:L / I:L / A:L: limited confidentiality, integrity, and availability impact, consistent with command execution scoped to the selected remote account.

Business impact. Termix functions as a control plane for SSH access to managed servers; compromise of that trusted position can undermine the security of every host reachable through it. Because execution occurs on the target host under the selected account, blast radius extends to managed infrastructure rather than being confined to the Termix application. Organizations running Termix as a centralized jump/management platform face elevated risk from lateral movement into production systems. The High privilege requirement and Low impact subscores temper the score, but the change-of-scope property makes this a meaningful infrastructure risk where Termix has high-privilege remote accounts configured. No evidence of active exploitation, threat-actor campaigns, or KEV listing is available.

Detection Guidance

Detection focuses on two layers: application logs showing anomalous credential-deployment requests, and host/network telemetry revealing shell metacharacters reaching remote grep/shell execution. Since the injection crosses into the remote host, host-based monitoring on managed endpoints is essential.

Sigma Rule

title: Potential Termix SSH Key Deployment Command Injection (CVE-2026-79761)
id: 8f2c1a44-9d3b-4e77-b6a1-7c5e0f9a2b31
status: experimental
description: Detects command-substitution or quote-breaking shell syntax in SSH key deployment requests targeting the Termix credential-deploy flow.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-79761
author: valtersit.com
date: 2026-01-01
logsource:
    category: webserver
    product: termix
detection:
    selection_endpoint:
        cs-uri-stem|contains:
            - '/credential-deploy'
            - '/credential/deploy'
    selection_injection:
        cs-uri-query|contains:
            - '$('
            - '`'
            - '; '
            - '| '
            - '&&'
            - '../'
    condition: selection_endpoint and selection_injection
fields:
    - c-ip
    - cs-uri-query
    - cs-method
falsepositives:
    - Legitimate public keys or tokens containing backticks or special characters (rare)
level: high

YARA Rule

rule CVE_2026_79761_Termix_KeyDeploy_Injection
{
    meta:
        description = "Detects shell command-substitution or quote-breaking syntax in Termix credential deployment payloads / logs (CVE-2026-79761)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79761"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep1 = "credential-deploy" ascii wide nocase
        $ep2 = "credential-deploy-routes" ascii wide nocase
        $inj1 = "$(" ascii
        $inj2 = "`" ascii
        $grep = "grep -F" ascii wide nocase
        $skey = "ssh-rsa" ascii wide nocase
        $ekey = "ssh-ed25519" ascii wide nocase

    condition:
        (any of ($ep1, $ep2, $grep)) and
        (any of ($inj1, $inj2)) and
        (any of ($skey, $ekey))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-79761 Termix SSH Key Deployment Command Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"credential-deploy"; http.request_body; content:"$("; nocase; http.request_body; content:"ssh-rsa"|20|; nocase; classtype:web-application-attack; reference:cve,2026-79761; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79761; sid:202679761; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=2m
  [network where http.request.method == "POST" and
     http.request.path : ("*credential-deploy*" or "*credential/deploy*") and
     http.request.body.text : ("*$(*" or "*`*")]
  [network where http.request.method == "POST" and
     http.request.path : ("*credential-deploy*" or "*credential/deploy*")]

Splunk SPL Query

index=web OR index=termix sourcetype=access_combined OR sourcetype=termix_app
(method=POST uri_path IN ("*credential-deploy*","*credential/deploy*"))
| eval inj=if(match(_raw,"\$\\(|`|\\|\\||&&|;\\s"), "shell_meta", "clean")
| where inj="shell_meta"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(clientip) as src_ips by user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,termix,cve-2026-79761,">
  <rule id="202679761" level="12">
    <decoded_as>json</decoded_as>
    <field name="uri_path">credential-deploy|credential/deploy</field>
    <regex type="pcre2">\$\(|`|\|\||&amp;&amp;|;\s</regex>
    <description>CVE-2026-79761: Termix SSH key deployment command injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

The NVD description states the issue "is fixed in version 2.5.1," but no vendor advisory, commit hash, release note, or tracked patch source is available to independently corroborate remediation. Treat this as UNPATCHED in the sense of unverified fix evidence; validate any available 2.5.1+ release against the vulnerability before relying on it.

1. Immediate mitigations.

   • Restrict access to the Termix credential-deployment function to the smallest possible set of trusted administrators; enforce strong authentication and MFA on all Termix accounts.
   • Do not expose Termix directly to the internet; place it behind a VPN or zero-trust access proxy and limit reachable source networks.
   • Remove or reduce high-privilege remote accounts configured for credential deployment; use least-privilege, non-root deployment accounts on target hosts.
   • If feasible, temporarily disable the SSH key deployment feature until a verified fix is applied.
   • Monitor Termix and remote-host logs for shell metacharacters ($(, backticks, ;, |, &&) in credential-deployment requests.

2. Patch / upgrade steps.

   • Upgrade Termix to 2.5.1 or later if available from the vendor, and verify the credential-deployment code path no longer interpolates user-controlled tokens into shell commands (e.g., re-validates input and avoids shell string concatenation).
   • Confirm the fix through code review or controlled negative testing; do not assume the version label alone guarantees remediation given the 0/4 patch confidence.
   • Re-check release notes at the vendor repository/distribution channel for the authoritative advisory.

3. Long-term hardening.

   • Refactor the credential-deploy flow to pass parameters to the target via argument arrays / safe APIs (execve-style) rather than concatenating untrusted data into shell strings; avoid double-quoted interpolation entirely.
   • Apply strict allow-list validation to public-key tokens (length, character set, and token type).
   • Enforce least privilege on all remote deployment accounts and segment management-plane access from production networks.
   • Add SAST/DAST coverage for CWE-78 patterns in backend route handlers and include shell-injection test cases in CI.

References

• NVD — CVE-2026-79761: https://nvd.nist.gov/vuln/detail/CVE-2026-79761
• MITRE CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-79761 NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score published for this CVE at time of writing): https://www.first.org/epss/
• CVSS 3.1 Specification (vector interpretation): https://www.first.org/cvss/v3.1/specification-document

No threat-actor campaigns, public PoC, or in-the-wild exploitation evidence are currently associated with CVE-2026-79761.