CVE-2026-53546

Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.3.2

Description An authenticated low-privileged user can cause the platform to authenticate to an attacker-controlled SSH server, leading to the disclosure of another user's stored SSH password or private-key material while the victim's data key is unlocked. This occurs because the terminal WebSocket accepts a user-controlled hostConfig.id, and the resolveHostById() function in src/backend/ssh/host-resolver.ts resolves the host without verifying ownership or explicit access. When no credential is shared, the system performs an owner credential fallback, and src/backend/ssh/terminal.ts combines that credential with attacker-controlled ip, port, and username values.

Recommendations Update to version 2.3.2.