Web-based Server Management Platform Vulnerability in Termix
CVE-2026-53546

9.6CRITICAL

Key Information:

Vendor

Termix-ssh

Status
Termix
Vendor
CVE Published:
19 August 2026

What is CVE-2026-53546?

Termix, a web-based server management platform, has a security flaw that allows low-privileged authenticated users to exploit the terminal WebSocket functionality. This vulnerability arises from the ability to pass user-controlled parameters that the host resolver processes without proper validation. Consequently, an attacker can impersonate the Termix server with their own SSH server and can extract sensitive information, including another user's stored SSH credentials, when their data key is unlocked. This issue has been addressed in version 2.3.2, which users are strongly advised to upgrade to.

Affected Version(s)

Termix < 2.3.2

References

https://github.com/Termix-SSH/Termix/security/advisories/...
x_refsource_CONFIRM
https://github.com/Termix-SSH/Termix/pull/874
x_refsource_MISC
https://github.com/Termix-SSH/Termix/commit/52f4e51ae03b5...
x_refsource_MISC

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.