CVE-2026-42454
Last modified
CVE-2026-42454 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, all Docker container management endpoints in Termix interpolate the containerId URL path parameter and WebSocket message field directly into shell commands executed via ssh2.Client.exec() on remote managed servers without any sanitization or validation. EPSS estimates a 0.65% chance of exploitation in the next 30 days.
Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, all Docker container management endpoints in Termix interpolate the containerId URL path parameter and WebSocket message field directly into shell commands executed via ssh2.Client.exec() on remote managed servers without any sanitization or validation. An authenticated attacker can inject arbitrary OS commands by crafting a malicious container ID, achieving Remote Code Execution on any managed server. This issue has been patched in version 2.1.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-42454?
How severe is CVE-2026-42454?
How do I fix CVE-2026-42454?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-42448Magic Wormhole makes it possible to get arbitrary-sized file…3.5
- CVE-2026-42449n8n-MCP is an MCP server that provides AI assistants access …8.5
- CVE-2026-42450OpenColorIO is a color management framework for visual effec…8.4
- CVE-2026-42451Grimmory is a self-hosted digital library. Prior to version …6.3
- CVE-2026-42452Termix is a web-based server management platform with SSH te…8.1
- CVE-2026-42453Termix is a web-based server management platform with SSH te…8.7
- CVE-2026-42455Linkwarden is a self-hosted, open-source collaborative bookm…8.8
- CVE-2026-42456AnythingLLM is an application that turns pieces of content i…4.3
- CVE-2026-42457vCluster Platform provides a Kubernetes platform for managin…9
- CVE-2026-42458Magento Long Term Support (LTS) is an unofficial, community-…5.3
- CVE-2026-42459free5GC is an open-source implementation of the 5G core netw…7.5
- CVE-2026-42461Arcane is an interface for managing Docker containers, image…7.5
Are you affected by CVE-2026-42454?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST