CVE-2026-53546

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When no credential is shared with the requester, resolveHostById performs an owner credential fallback, and src/backend/ssh/terminal.ts combines that credential with attacker-controlled ip, port, and username values. An authenticated low-privileged user can therefore make Termix authenticate to an attacker-controlled SSH server and disclose another user's stored SSH password or private-key material while the victim user's data key is unlocked. This issue is fixed in version 2.3.2.

• CWE-639
• CWE-862

• https://github.com/Termix-SSH/Termix/commit/52f4e51ae03b5b8d2608e1383e2ccf79d290132b
• https://github.com/Termix-SSH/Termix/pull/874
• https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag
• https://github.com/Termix-SSH/Termix/security/advisories/GHSA-57gp-39c7-4g9r
• https://github.com/Termix-SSH/Termix/security/advisories/GHSA-57gp-39c7-4g9r

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53539Python-Multipart is a streaming multipart parser for Python.…7.5
• CVE-2026-5354A flaw has been found in Trendnet TEW-657BRM 1.00.1. Affecte…8.8
• CVE-2026-53540Python-Multipart is a streaming multipart parser for Python.…3.7
• CVE-2026-53541OliveTin gives access to predefined shell commands from a we…4.3
• CVE-2026-53542Termix is a web-based server management platform with SSH te…8.8
• CVE-2026-53545Termix is a web-based server management platform with SSH te…9.8
• CVE-2026-53547Termix is a web-based server management platform with SSH te…8.8
• CVE-2026-53548Termix is a web-based server management platform with SSH te…9.6
• CVE-2026-53549Termix is a web-based server management platform with SSH te…7.7
• CVE-2026-5355A vulnerability has been found in Trendnet TEW-657BRM 1.00.1…8.8
• CVE-2026-53550js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2…5.3
• CVE-2026-53551free5GC is an open-source implementation of the 5G core netw…6.9