CVE-2026-53549

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-53549
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53549.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53549
Aliases
  • GHSA-x9pr-795g-rm5f
Published
2026-08-19T20:34:22Z
Modified
2026-08-27T11:31:04Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Termix: Server-Side Request Forgery via Proxy Connectivity Test
Details

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The testProxyConnectivity path uses raw TCP and SOCKS connections to attacker-selected hosts and ports, allowing an authenticated user to probe localhost, private networks, link-local metadata services, and other infrastructure reachable from the Termix server. Structured connection errors disclose host reachability and timing information, and successful metadata access can expose cloud credentials. This issue is fixed in version 2.3.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53549.json"
}
References

Affected packages

Git / github.com/termix-ssh/termix

Affected ranges

Type
GIT
Repo
https://github.com/termix-ssh/termix
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
52f4e51ae03b5b8d2608e1383e2ccf79d290132b
Fixed
c3282b5dca081d52513e94329bbc71084338217d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

release-1.*
release-1.10.0-tag
release-1.11.0-tag
release-1.11.1-tag
release-1.11.2-tag
release-1.4.0-tag
release-1.5.0-tag
release-1.6.0-tag
release-1.7.0-tag
release-1.7.1-tag
release-1.7.2-tag
release-1.7.3-tag
release-1.8.0-tag
release-1.9.0-tag
release-2.*
release-2.0.0-tag
release-2.1.0-tag
release-2.2.0-tag
release-2.2.1-tag

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53549.json"