CVE-2026-79760 Termix-SSH CVE debrief

Who should care

Defenders responsible for Termix servers, especially those with webhook or ntfy notification channels configured, should assess exposure and verify the impact of internal service requests.

Why it matters

CVE-2026-79760 allows authenticated users to trigger server-side requests to internal HTTP services, potentially leading to unauthorized requests and limited state changes. Defenders should prioritize verifying exposure and assessing impact.

• Potential for unauthorized internal service requests
• Possible limited state changes in internal services
• Need for verification of affected deployments and scope
• Priority for updating to version 2.5.1 or later

Technical summary

The vulnerability in Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests through the notification-channel test endpoint. This permits blind requests to internal HTTP services reachable by the Termix server. The issue is fixed in version 2.5.1 and affects Termix versions from 2.5.0 until 2.5.1. The vulnerability can cause limited state changes when an internal service accepts the fixed notification body, although response bodies are not returned. Defenders should prioritize verifying exposure and assessing impact.

Defensive priority

Defenders should prioritize verifying exposure of Termix servers, especially those with webhook or ntfy notification channels configured, and assess the impact of internal service requests.

Recommended defensive actions

• Verify exposure of Termix servers, especially those with webhook or ntfy notification channels configured
• Assess the impact of internal service requests
• Update to version 2.5.1 or later
• Monitor server-side requests for unusual activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the scope of affected deployments and potential impact on internal services require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.