# CVE-2026-79760: Termix server-side request forgery in notification test

Source: https://junglewise.ai/threats/cve-2026-79760-termix-is-a-web-based-server-management-platform-with-ssh  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-79760 · Severity: medium · CVSS 6.4 · Published 2026-09-24

Termix is a web-based platform for managing servers via SSH terminal and file editing. Authenticated users can trick it into sending HTTP requests to internal systems by configuring webhook notifications with malicious URLs, potentially accessing or modifying internal services that the Termix server can reach. This bypasses network isolation and allows attackers to attack internal infrastructure from within the application.

Technologies: [Termix-SSH Termix](https://junglewise.ai/threats/technologies/termix). Vendors: [Termix-SSH](https://junglewise.ai/threats/vendors/termix-ssh).

## Quick answers

**Is CVE-2026-79760 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79760 being exploited in the wild.

**How severe is CVE-2026-79760?** Medium severity, with a CVSS score of 6.4, published 24 September 2026.

**Which products and versions are affected?** Termix-SSH Termix 2.5.0 before 2.5.1.

**Is there a fix for CVE-2026-79760?** A patch was published on 2026-07-19: version 2.5.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79760 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-79760?** Check whether you run Termix-SSH Termix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) in the notification-channel test endpoint (alert-rules-routes.ts → notification-sender.ts) that lacks destination allowlisting or private-address filtering. Authenticated users can configure webhook/ntfy channels with arbitrary URLs and trigger requests via the test endpoint; webhook mode also permits attacker-controlled HTTP methods and headers. While response bodies are not returned, an attacker can probe internal services and potentially trigger state changes on services that accept the fixed notification body.

## Affected products

- Termix-SSH Termix 2.5.0 before 2.5.1

## Timeline

- 2026-09-24: disclosed
- 2026-07-19: patched: version 2.5.1 released

## References

- [https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e](https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e)
- [https://github.com/Termix-SSH/Termix/commit/e1d1a3e53d65794ec2f23099bafe77fdfdd11648](https://github.com/Termix-SSH/Termix/commit/e1d1a3e53d65794ec2f23099bafe77fdfdd11648)

## Related threats

- [Termix file-manager path traversal in transferToHost](https://junglewise.ai/threats/cve-2026-120322-a-vulnerability-was-identified-in-termix-ssh-termix-up-to-2-9-2)
- [Termix command injection in ACME SSL settings](https://junglewise.ai/threats/cve-2026-79766-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix server management platform SSRF via proxy endpoint](https://junglewise.ai/threats/cve-2026-79764-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix two-factor authentication bypass in TOTP disable endpoints](https://junglewise.ai/threats/cve-2026-79763-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix weak key derivation in OIDC and WebAuthn user encryption](https://junglewise.ai/threats/cve-2026-79762-termix-is-a-web-based-server-management-platform-with-ssh)