CVE-2026-79761 Termix-SSH CVE debrief

Who should care

Defenders responsible for Termix servers and users with SSH key deployment privileges should assess exposure and apply the vendor-provided fix. This includes IT personnel managing Termix installations, security teams reviewing vulnerability exposure, and operators using SSH key deployment features. Prioritization should be given to verifying exposure and applying the fix to prevent potential command execution with remote account privileges.

Why it matters

CVE-2026-79761 is a command injection vulnerability in Termix that allows authenticated users to execute commands on target hosts. Defenders should prioritize verifying exposure and applying the vendor-provided fix to prevent potential command execution with remote account privileges.

• Command execution with remote account privileges.
• Potential for lateral movement within the network.
• Need for verification of Termix version and exposure.
• Priority for applying the vendor-provided fix.

Technical summary

The Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. An authenticated user can deploy a crafted SSH credential to execute commands with the selected remote account's privileges. This occurs because the grep -F verification paths in src/backend/database/routes/credential-deploy-routes.ts accept command substitution or quote-breaking shell syntax in keyPattern. The issue is addressed in version 2.5.1.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor-provided fix, as the vulnerability allows for command execution with remote account privileges.

Recommended defensive actions

• Verify Termix version and check if it's within the affected range (1.7.0 to 2.5.1).
• Apply the vendor-provided fix in version 2.5.1.
• Restrict access to Termix SSH key deployment features to trusted users.
• Monitor Termix logs for suspicious command execution activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. However, additional information on exploitation or victim impact is not available. The vulnerability is confirmed to exist in versions 1.7.0 through 2.5.1 of Termix. Defenders should verify the version of Termix in use and check for exposure. The vendor-provided fix in version 2.5.1 should be applied to prevent exploitation. Further details on the vulnerability can be found in the official CVE Program record and NIST NVD detail.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.