CVE-2026-45748: Termix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command Injection

Synopsis

Command injection in Termix, a web-based server management platform with SSH terminal and tunneling capabilities, allows an unauthenticated remote attacker to inject arbitrary OS commands through the POST /ssh/tunnel/connect endpoint. The endpoint interpolates user-controlled fields (endpointIP, endpointUsername, password) directly into a shell command without sanitization; the vulnerability is reachable over the network with no credentials required. Successful exploitation gives the attacker persistent OS-level code execution on the source SSH host. A patched-image rebuild at version 2.3.2 is available on HarborGuard for environments running an affected version of Termix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the Termix service to exploit it.

• AuthenticationNot required

  No credentials or session token are needed; the POST /ssh/tunnel/connect endpoint accepts unauthenticated requests.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout knowledge, or environmental factors are required to inject commands successfully.

Blast Radius

• The attacker executes arbitrary OS commands with the privileges of the Termix process on the source SSH host, enabling full host compromise.
• All secrets stored or accessible on that host, including SSH keys, credentials cached in environment variables, and configuration files, are readable.
• The attacker can modify or delete files on the host, tamper with SSH tunnel configurations, and pivot to downstream systems reachable through configured tunnels.
• The Termix service and any co-located services can be crashed or disabled, causing a loss of management access to all systems administered through the platform.