External risk intelligence

Termix Unauthenticated Access to SSH Host Credentials.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2025-59951

Termix is a web-based server management platform designed to be accessed over the network to provide SSH, tunneling, and file editing capabilities. As an administrative interface commonly deployed to manage infrastructure, it is typically hosted as a reachable service. The vulnerability exposes sensitive management endpoints directly to the network, making it likely to be reachable if the application is exposed.

Termix

0.1.1 to 1.6.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Termix server management platform, specifically within its official Docker image. This issue allows unauthorized access to sensitive SSH host information, including credentials, due to an improper handling of the client's IP address when a reverse proxy is used. The exposure of this data poses a significant security risk.

Unauthenticated access to SSH credentials.
Critical system information can be exposed remotely.
Confirm if Termix is deployed and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach and trigger this vulnerability by interacting with the Termix web interface without needing any prior authentication. Because the platform incorrectly identifies network connections as local, an unauthorized user can directly access an endpoint that stores sensitive SSH credentials. This allows an attacker to gain access to stored system credentials.

No authentication required to access.
Direct access to sensitive endpoint.
Exposed SSH credentials.

Live Threat

Current exploitation, exposure, and threat context

When improperly configured with a reverse proxy, Termix versions prior to 1.6.0 can allow unauthenticated access to an endpoint that records sensitive SSH host information, including addresses, usernames, and passwords. This affects users of the official Docker image, custom images built from the official Dockerfile, or those utilizing reverse proxy functionality.

Stored SSH host credentials.
Direct network access to an unauthenticated endpoint.
Exposure of sensitive system access information.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for securing Termix, particularly those managing web-based server administration platforms or using official Docker images. The first step is to identify all instances of Termix, confirm their network reachability and business criticality, and then assign an accountable owner to prioritize remediation based on the potential for unauthorized access to sensitive SSH host information.

Assign ownership to the platform or application team.
Verify all Termix deployments and their exposure.
Plan remediation based on identified risk and impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Termix?

Termix is a web-based management platform that provides engineers with SSH terminal, tunneling, and file editing tools directly in their browser. Because it centralizes infrastructure control, it acts as a hub for managing multiple remote servers, which is why it is frequently deployed within containerized environments using Docker.

How does CVE-2025-59951 impact authentication?

This vulnerability relates to improper access control and untrusted header handling. Because the application incorrectly interprets the reverse proxy's IP address as a local connection, it mistakenly assumes the request originates from the server itself. This bypasses security checks and allows unauthenticated access to internal API endpoints that should be restricted.

Do I need to be authenticated to trigger this bug?

No. This vulnerability does not require any credentials or prior access to the Termix interface. As long as the application is configured with a reverse proxy or uses the official Docker image, the sensitive endpoint is exposed to anyone who can reach the web service. Installations that do not use a reverse proxy or that have already been updated to version 1.6.0 are not subject to this specific bypass.

Is my instance relevant according to Halo Surface Signal?

Yes, if your instance is reachable over the network. Halo Surface Signal identifies Termix as a management platform typically hosted as a reachable service. Because it is designed for administrative access, the risk is elevated if the interface is accessible from external networks, as this increases the likelihood that an attacker could find and interact with the vulnerable endpoint.

What is the first step to secure my Termix environment?

The most effective action is to identify every deployed instance of Termix across your infrastructure. Once identified, verify if they are using the affected Docker configurations and prioritize upgrading to version 1.6.0. Since this flaw exposes saved SSH credentials, ensure that any instance potentially accessed by unauthorized parties has its SSH keys and passwords rotated immediately after patching.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.