Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.4
CVE-2026-79760: Termix lets logged‑in users trigger internal network requests
CVE-2026-79760 · published 1 month ago
Summary
When using Termix version 2.5.0 through 2.5.1, a logged‑in user can set up a notification channel with a URL they control and use the test feature to make the server contact internal web services. This can expose internal systems to hidden requests and, in some cases, cause limited changes on those services. Updating to version 2.5.1 removes the unsafe behavior.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| termix-ssh | termix | >= 2.5.0, < 2.5.1 |
Original advisory text
Termix: Authenticated blind SSRF through notification channel test endpoints
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests through the notification-channel test endpoint. The request path in src/backend/database/routes/alert-rules-routes.ts reaches src/backend/utils/notification-sender.ts without destination allowlisting or private-address blocking. This permits blind requests to internal HTTP services reachable by the Termix server. Webhook mode also permits attacker-controlled HTTP methods and headers, which can cause limited state changes when an internal service accepts the fixed notification body, although response bodies are not returned. This issue is fixed in version 2.5.1.
References
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-6hx3-9mgq-h9fj Vendor Advisory
- https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1c... Patch
- https://github.com/Termix-SSH/Termix/commit/e1d1a3e53d65794ec2f23099bafe77fdfdd1... Patch
- https://github.com/Termix-SSH/Termix/pull/1067 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79760... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-79760 Vendor Advisory
- https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag URL
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published24 Sep 2026
Updated4 Nov 2026
First seen24 Sep 2026
Track software like this
Free during beta