Web-Based Server Management Platform Vulnerability in Termix

CVE-2026-53549

What is CVE-2026-53549?

Termix, a web-based server management platform, exposes a critical security flaw affecting versions prior to 2.3.2. The vulnerability lies in the unvalidated acceptation of proxy-related request fields at the POST /host/db/proxy/test endpoint. This oversight permits authenticated users to connect to arbitrary hosts and ports, which can lead to probing sensitive resources within localhost or private networks. Consequently, attackers may exploit this to access metadata services and potentially extract cloud credentials, thereby posing significant risks to the underlying infrastructure. The issue has been rectified in the latest release (2.3.2) with improved validations to mitigate these threats.

References