CVE-2026-79760

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-79760
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79760.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-79760
Aliases
  • GHSA-6hx3-9mgq-h9fj
Published
2026-09-24T15:46:46Z
Modified
2026-09-26T03:47:42Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L CVSS Calculator
Summary
Termix: Authenticated blind SSRF through notification channel test endpoints
Details

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests through the notification-channel test endpoint. The request path in src/backend/database/routes/alert-rules-routes.ts reaches src/backend/utils/notification-sender.ts without destination allowlisting or private-address blocking. This permits blind requests to internal HTTP services reachable by the Termix server. Webhook mode also permits attacker-controlled HTTP methods and headers, which can cause limited state changes when an internal service accepts the fixed notification body, although response bodies are not returned. This issue is fixed in version 2.5.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79760.json"
}
References

Affected packages

Git / github.com/termix-ssh/termix

Affected ranges

Type
GIT
Repo
https://github.com/termix-ssh/termix
Events
Introduced
9de904dd4c31d4e0538891e9c02c0a31d6a3b512
Fixed
ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e
Fixed
e1d1a3e53d65794ec2f23099bafe77fdfdd11648
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.5.0"
        },
        {
            "fixed":  "2.5.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

release-2.*
release-2.5.0-tag

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79760.json"