# CVE-2026-79759: Termix credential access control bypass in deployment endpoint

Source: https://junglewise.ai/threats/cve-2026-79759-termix-is-a-web-based-server-management-platform-with-ssh  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-79759 · Severity: medium · CVSS 4.3 · Published 2026-09-24

Termix is a web-based SSH terminal and server management platform. An unauthenticated attacker can access other users' stored SSH credentials and deploy them to arbitrary hosts by exploiting an access control flaw in the credential deployment endpoint. This allows an attacker to launch unauthorized SSH connections to victims' target systems using their own keys, potentially gaining foothold access to critical infrastructure.

Technologies: [Termix-SSH Termix](https://junglewise.ai/threats/technologies/termix). Vendors: [Termix-SSH](https://junglewise.ai/threats/vendors/termix-ssh).

## Quick answers

**Is CVE-2026-79759 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79759 being exploited in the wild.

**How severe is CVE-2026-79759?** Medium severity, with a CVSS score of 4.3, published 24 September 2026.

**Which products and versions are affected?** Termix-SSH Termix 1.7.0 to 2.5.0.

**Is there a fix for CVE-2026-79759?** A patch was published on 2026-07-19: Version 2.5.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79759 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-79759?** Check whether you run Termix-SSH Termix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The POST /credentials/:id/deploy-to-host endpoint fails to validate that credential and target-host records belong to the requesting user, accepting arbitrary integer IDs. Differential error responses disclose the existence and authentication type (password or key) of each record. While encrypted passwords and keys are not directly exposed, an attacker can trigger SSH key deployment to target hosts, enabling SSH connection attempts using the attacker's public key on any key-authenticated system.

## Affected products

- Termix-SSH Termix 1.7.0 to 2.5.0

## Timeline

- 2026-09-24: disclosed
- 2026-07-19: patched: Version 2.5.1 released

## References

- [https://github.com/Termix-SSH/Termix/commit/b0598294a6aeed866f51ce58067f43c1d751c7a6](https://github.com/Termix-SSH/Termix/commit/b0598294a6aeed866f51ce58067f43c1d751c7a6)
- [https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e](https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e)

## Related threats

- [Termix file-manager path traversal in transferToHost](https://junglewise.ai/threats/cve-2026-120322-a-vulnerability-was-identified-in-termix-ssh-termix-up-to-2-9-2)
- [Termix command injection in ACME SSL settings](https://junglewise.ai/threats/cve-2026-79766-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix server management platform SSRF via proxy endpoint](https://junglewise.ai/threats/cve-2026-79764-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix two-factor authentication bypass in TOTP disable endpoints](https://junglewise.ai/threats/cve-2026-79763-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix weak key derivation in OIDC and WebAuthn user encryption](https://junglewise.ai/threats/cve-2026-79762-termix-is-a-web-based-server-management-platform-with-ssh)