CVE-2026-79762

Executive Summary

CVE-2026-79762 is a cryptographic key derivation flaw in Termix, a web-based server management platform offering SSH terminal, tunneling, and file editing functionality. From version 1.7.0 until 2.5.1, the application derives the Data Encryption Key (DEK) wrapping keys for OIDC and WebAuthn-authenticated users from committed default strings combined with the public userId salt, rather than from properly secured secrets. An attacker who obtains an offline copy of the SQLite database can reproduce the key derivation, unwrap affected users' DEKs, and decrypt stored SSH passwords, private keys, and key passphrases. The vulnerability carries a CVSS 3.1 base score of 5.5 and requires local access to the database file; no public proof-of-concept or exploit code is currently available.

Technical Analysis

The vulnerability resides in Termix's src/backend/utils/user-crypto.ts file, where the wrapping keys that protect users' Data Encryption Keys (DEKs) are generated. According to the NVD description, the affected code path constructs these wrapping keys from committed default strings in combination with the public userId salt, rather than from environment-specific cryptographic secrets.

The core weakness is catalogued as CWE-321 (Use of Hard-coded Cryptographic Key). Two environment variables — OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET — are intended to provide the secret material for the key derivation. However, the project's default deployment artifacts do not configure these variables. When they are absent, the application falls back to committed default strings that are present in the source code or repository. Because the userId value used as a salt is public (server-side generated but observable/derivable) and the fallback secret strings are static and shipped with the project, the entire key derivation input becomes deterministic and reproducible by anyone with knowledge of the codebase.

The attack surface is the offline SQLite database used by Termix to store user data. The database contains the wrapped DEKs for each user. With a copy of that database, an attacker reconstructs the same wrapping key using the committed default strings and the public userId salt, then unwraps each affected user's DEK. The recovered DEK in turn decrypts the user's stored secrets: SSH passwords, private keys, and key passphrases.

Two important scoping details are stated explicitly in the description:

• The flaw affects OIDC-authenticated and WebAuthn-authenticated users, whose DEKs are protected by this specific wrapping key derivation path.
• Password-authenticated users are not affected by this specific key derivation path — implying a distinct key derivation mechanism is used for that authentication cohort.

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a local access prerequisite, low attack complexity, low privileges required, no user interaction, and a high confidentiality impact with no integrity or availability impact. The high confidentiality impact is consistent with full recovery of SSH credentials, which are high-value secrets granting access to managed infrastructure.

No public PoC, exploit code, or Nuclei template exists for this CVE. All analysis below is derived strictly from the described mechanism.

Exploitation Scenarios

No public PoC is available; the attack chain described here is inferred from the vulnerability class (hard-coded cryptographic key material, CWE-321) and the specifics given in the NVD description.

1. Reconnaissance / target identification. An attacker identifies a Termix deployment. Because the flaw depends on the default deployment configuration, the attacker determines whether the target runs a version in the range 1.7.0 through 2.5.0 and whether it was deployed without setting the OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET environment variables. Default or unmodified deployment artifacts are the indicator that the committed default strings are in use.

2. Obtaining the database. The specific prerequisite is offline access to the SQLite database file. This may be achieved through any of several path-level avenues — for example, a backup archive, a filesystem snapshot, a container volume, or any exposure that yields the database file rather than a live query interface. The attacker does not need the application to be running; the attack is entirely offline.

3. Triggering the cryptographic flaw. Using a local copy of the SQLite database, the attacker reads the wrapped Data Encryption Keys for each user and the corresponding public userId salts. The attacker then reproduces the wrapping-key derivation used in src/backend/utils/user-crypto.ts by supplying the committed default strings (stand-ins for OIDC_SYSTEM_SECRET / WEBAUTHN_SYSTEM_SECRET) together with the public userId salt. Because these inputs are deterministic and available to the attacker, the reconstructed wrapping key matches the one used in production.

4. Execution and post-exploitation impact. With the reconstructed wrapping key, the attacker unwraps each affected user's DEK. The recovered DEK decrypts the stored SSH passwords, private keys, and key passphrases for that user. The result is credential compromise affecting every OIDC- or WebAuthn-authenticated user whose data resides in the copied database. Possession of SSH private keys and passwords enables lateral movement to the servers Termix was used to manage. Password-authenticated users are outside this specific derivation path and are not compromised through this technique.

The principal operational constraint is the offline database access requirement; the cryptographic step itself is deterministic and requires no brute force. No network exploitation, no authentication bypass, and no user interaction are involved.

Impact Assessment

The CVSS 3.1 base score is 5.5 (Medium), with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Subscore implications:

• AV:L (Local): The attacker must gain local access to the database file. This is the primary limiting factor keeping the overall score at Medium. It reflects that the database copy is a precondition, not a remotely reachable service flaw.
• AC:L (Low): Once the database is in hand, no special conditions or race timing are required; the key derivation is deterministic.
• PR:L (Low): Low privileges are sufficient — the attacker does not need administrative rights on the Termix application, only possession of the database artifact.
• UI:N (None): No victim interaction is required; the process is fully offline.
• S:U (Unchanged): The compromise does not, in scope terms, escape the impacted security authority through this path alone.
• C:H (High): Full recovery of SSH passwords, private keys, and passphrases is a high confidentiality impact.
• I:N / A:N: No integrity or availability impact is inherent to this flaw.

Business impact. Termix centrally manages servers via SSH, so a single recovered DEK can expose credentials to many managed hosts. Compromise of SSH private keys or passwords defeats the primary authentication control on those servers and enables lateral movement, persistent access, and potential full infrastructure compromise. The exposure is not limited to the Termix application itself — it cascades to every host whose credentials were stored through the platform.

Blast radius. All OIDC-authenticated and WebAuthn-authenticated users whose wrapped DEKs and encrypted secrets reside in the compromised SQLite database. Password-authenticated users are explicitly not affected by this specific key derivation path. Multiple users can be impacted simultaneously from a single database copy, and the attack is silent and permanent unless affected credentials are rotated, because the stolen secrets remain valid until changed.

No CISA KEV listing, no EPSS score, and no observed exploitation in the wild are currently reported.

Detection Guidance

Because exploitation is offline against a copied database, network-only detection has limited reach; the detection strategy below therefore emphasizes host artifacts, file-access telemetry, and code/secret scanning rather than on-wire signatures. The network rules are provided for the case where database exfiltration or unusual access to backend files occurs over monitored channels.

Sigma Rule

title: Suspicious Access or Copy of Termix SQLite Database
id: 4f2a9c1e-7b3d-4e6a-9c2f-1a2b3c4d5e6f
status: experimental
description: Detects file access, copy, or exfiltration attempts targeting the Termix application database or backend crypto utility, consistent with offline exploitation of CVE-2026-79762.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79762
author: Threat Intelligence
date: 2026-01-01
tags:
  - attack.credential-access
  - attack.t1552
logsource:
  category: file_event
  product: linux
detection:
  selection_db:
    TargetFilename|endswith:
      - '.sqlite'
      - '.sqlite3'
      - '.db'
  selection_path:
    TargetFilename|contains:
      - 'termix'
      - 'Termix'
  selection_crypto:
    TargetFilename|contains:
      - 'user-crypto'
  condition: (selection_db and selection_path) or selection_crypto
falsepositives:
  - Legitimate backups performed by administrators
  - Application-native database maintenance jobs
level: medium

YARA Rule

rule CVE_2026_79762_Termix_Default_Crypto_Secret
{
    meta:
        author = "Threat Intelligence"
        description = "Detects Termix user-crypto artifacts or deployment files referencing default/committed system secrets associated with CVE-2026-79762"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79762"
        date = "2026-01-01"

    strings:
        $s1 = "user-crypto" ascii
        $s2 = "OIDC_SYSTEM_SECRET" ascii
        $s3 = "WEBAUTHN_SYSTEM_SECRET" ascii
        $s4 = "userId" ascii
        $s5 = "Termix" ascii

    condition:
        uint32(0) != 0x504b0304 and
        filesize < 5MB and
        (($s2 and $s3) or ($s1 and $s4 and $s5))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-79762 Termix - Possible Offline Database Exfiltration Attempt (Suspicious .sqlite/.db download)"; flow:to_client,established; content:"Content-Disposition"; http_header; content:".sqlite"; http_header; nocase; sid:202679762; rev:1; metadata:reference nvd,cve CVE-2026-79762; classtype:attempted-user; priority:2;)

Elastic Detection

file where (file.name : "*.sqlite" or file.name : "*.sqlite3" or file.name : "*.db") and
  (file.path : "*termix*" or file.path : "*Termix*" or file.path : "*user-crypto*")

file where event.type in ("creation", "change") and
  (file.name : "*.sqlite" or file.name : "*.sqlite3" or file.name : "*.db") and
  (file.path : "*termix*" or file.path : "*user-crypto*")

Splunk SPL Query

index=endpoint OR index=filesystem (file_name="*.sqlite" OR file_name="*.sqlite3" OR file_name="*.db" OR file_path="*user-crypto*") (file_path="*termix*" OR file_path="*Termix*")
| stats count min(_time) as first_seen max(_time) as last_seen values(process_name) as processes values(dest) as hosts by file_path, user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="termix,cve-2026-79762,">
  <rule id="202679762" level="10">
    <decoded_as>syscheck</decoded_as>
    <field name="file">\.(sqlite|sqlite3|db)$</field>
    <description>CVE-2026-79762: Termix database file access/modification detected on monitored host - possible credential exfiltration for offline key recovery.</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
  <rule id="202679763" level="8">
    <decoded_as>syscheck</decoded_as>
    <field name="file">user-crypto</field>
    <description>CVE-2026-79762: Access to Termix backend crypto utility path detected - investigate potential offline key derivation activity.</description>
    <group>recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note: the NVD description states the issue is fixed in version 2.5.1; however, no patch reference, vendor advisory, or commit has been confirmed by the tracked sources feeding this report, so the patch-confidence score remains 0/4 pending verification.

1) Immediate mitigations

• Configure explicit, high-entropy values for OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET in the deployment environment so that committed default strings are never used as wrapping-key input. This removes the determinism that makes the derivation reproducible.
• Treat every SQLite database copy, backup, snapshot, and volume export as a high-value secret. Restrict file-system and backup access so that offline copies are not obtainable by low-privilege actors (Addresses AV:L / PR:L).
• Rotate all SSH passwords, SSH private keys, and key passphrases stored in Termix, particularly for OIDC- and WebAuthn-authenticated users. Because recovered secrets remain valid until changed, rotation is the only way to invalidate an already-performed offline recovery.
• Audit backup retention and access logs for historical copies of the database that may have been exposed.

2) Patch / upgrade steps

• Upgrade Termix to version 2.5.1, where the NVD description states the issue is fixed. Verify the upgrade against the project's release artifacts and confirm the fix changes the key derivation path away from committed default strings.
• After upgrading, confirm that OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET are set and that new wrapping keys no longer collide with values derived from the default deployment artifacts.
• Because no patch source has been confirmed by tracked providers (patch confidence 0/4), validate that the deployed 2.5.1 build corresponds to the upstream fixed release before considering the environment remediated.

3) Long-term hardening

• Eliminate all hard-coded cryptographic material from the codebase; adopt a secrets-management workflow so key material is injected at runtime and never committed (mitigates CWE-321 systemically).
• Perform static analysis and secret-scanning in CI to detect committed default secrets before release.
• Encrypt database backups and database-at-rest, and limit who can read them, to keep the offline-access precondition out of reach.
• Adopt a key rotation schedule for DEK wrapping keys so that a single disclosure does not have indefinite impact.
• Deploy file-integrity monitoring against the Termix database and user-crypto backend assets, and alert on unexpected reads or copies.

References

• NVD — CVE-2026-79762: https://nvd.nist.gov/vuln/detail/CVE-2026-79762
• CWE-321 — Use of Hard-coded Cryptographic Key: https://cwe.mitre.org/data/definitions/321.html
• MITRE ATT&CK — T1552 Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• CVSS 3.1 Specification: https://www.first.org/cvss/specification-document
• Termix project release information (verify version 2.5.1 fix upstream): consult the project's official repository/release notes

Threat actor campaigns / exploit-in-the-wild evidence: none reported. CVE-2026-79762 is not listed in CISA KEV, has no public PoC or exploit code, no Nuclei template, and has not yet been scored by FIRST.org EPSS.