CVE-2026-79758 Termix: Authenticated users can read other users' host status and clear global SSH connections
Authenticated users can read unauthorized host statuses and clear global SSH connections due to missing per-host authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-79758?
CVE-2026-79758 is a medium-severity missing authorization vulnerability in Termix-SSH Termix, published on 24 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET /status/:id accepts an attacker-supplied numeric host identifier, and POST /clear-connections permits a regular user to clear the global SSH connection pool. The affected src/backend/ssh/server-stats.ts routes expose host online or offline state and lastChecked timestamps and can disrupt other users' active sessions or pooled connections. Unauthenticated requests remain blocked, but authentication alone does not preserve tenant isolation. This issue is fixed in version 2.5.1.
Which versions are affected by CVE-2026-79758?
How do I fix CVE-2026-79758?
No fix has been published for CVE-2026-79758 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-79758 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-79758 exists.
Sources
Also known as GHSA-372w-6f3h-vcm4.