Loading story…
A critical vulnerability, tracked as CVE-2025-59951, was discovered in the official Docker image for Termix, a web-based server management platform. This flaw allows unauthenticated access to sensitive SSH credentials stored within the application. The vulnerability arises from the way the Docker image is configured with an Nginx reverse proxy, which causes the backend to always interpret incoming requests as originating from localhost. Specifically, the backend uses the req.ip method to determine the client's IP address, but due to the proxy configuration, it always receives the proxy's IP, resulting in the isLocalhost check returning true for all requests. As a result, the /ssh/db/host/internal endpoint, which stores SSH host information including addresses, usernames, and passwords, can be accessed without any authentication. This exposes all stored SSH credentials to anyone who can reach the endpoint, representing a severe security risk. The vulnerability affects all users of the official Termix Docker image up to and including version 1.5.0, as well as those who build their own images using the official Dockerfile or utilize the reverse proxy functionality. The issue is remotely exploitable, meaning attackers do not need local access to exploit the flaw. The vulnerability was assigned a CVSS 4.0 score of 9.2, indicating its critical severity. The problem has been addressed in Termix version 1.6.0, which corrects the proxy configuration to ensure proper client IP detection and authentication enforcement. Users are strongly advised to upgrade to version 1.6.0 or later to mitigate the risk. The vulnerability was publicly disclosed on October 1, 2025, and security advisories were issued to inform affected users. The exposure of SSH credentials could allow attackers to gain unauthorized access to managed servers, potentially leading to further compromise. Organizations using Termix in production environments are particularly at risk if they have not yet applied the update. The flaw highlights the importance of secure reverse proxy configurations and proper authentication checks in web-based management tools. Security researchers recommend auditing similar configurations in other applications to prevent analogous vulnerabilities. The incident underscores the need for timely patching and vigilant monitoring of security advisories for critical infrastructure components.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Termix addressed CVE-2025-59951 in version 1.6.0 and advised users to upgrade and review access controls for the exposed endpoint. This remediation closed the authentication bypass affecting earlier versions.
A critical authentication bypass vulnerability in the official Termix Docker image allowed unauthenticated access to the /ssh/db/host/internal endpoint because the backend trusted the reverse proxy IP as localhost. The flaw could expose stored SSH host data including addresses, usernames, and passwords in affected deployments using the official image, official Dockerfile, or reverse proxy functionality.
2 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several server and developer administration tools have disclosed severe code-execution vulnerabilities affecting exposed management functionality. **Termix** reported an authenticated OS command injection in `GET /ssh/file_manager/ssh/resolvePath`, where double-quoted user input allowed shell substitution via ``$(...)`` and backticks, enabling arbitrary commands on the connected remote host under the active SSH account. A separate **Termix** issue, tracked as `CVE-2026-45746`, affected versions prior to **2.3.2** and allowed attackers to tamper with a client-controlled `sessionId` to access other users' active File Manager SSH sessions, potentially leading to unauthorized file operations and remote code execution on another user's VPS. Other disclosures showed similar high-impact flaws in JavaScript-based backends. **DbGate** fixed an RCE in **v7.1.9** after researchers found that `POST /runners/start` and `POST /runners/load-reader` concatenated attacker-controlled values into generated JavaScript executed by a forked Node.js process; in anonymous-auth deployments, the issue could permit **unauthenticated RCE**. **BrowserStack Runner** through **0.9.5** was assigned `CVE-2026-49143` for an unauthenticated RCE in the `/_log` handler, where crafted JSON passed through `vm.runInNewContext()` and `eval()` allowed attackers to escape the sandbox and invoke `child_process` on reachable runner instances.
Jun 29, 2026
Threat actors have begun probing a critical authentication bypass in official Gitea Docker images, tracked as **CVE-2026-20896**, shortly after public disclosure and patch release. The flaw stems from a default configuration that sets `REVERSE_PROXY_TRUSTED_PROXIES = *`, causing Gitea to trust the `X-WEBAUTH-USER` header from any source IP when reverse-proxy authentication is enabled. An attacker that can directly reach the Gitea HTTP service can impersonate any existing user without a password or session cookie, including administrators, and may also create accounts if auto-registration is enabled. The issue affects Gitea Docker image deployments through **1.26.2** and was fixed in **1.26.3** and later by removing wildcard proxy trust and making reverse-proxy authentication opt-in. Researchers reported the first observed in-the-wild activity 13 days after disclosure, with reconnaissance tied to ProtonVPN-associated infrastructure, while public proof-of-concept details have increased the risk of broader exploitation. With roughly **6,200** internet-facing Gitea instances estimated to be exposed, organizations are being urged to upgrade immediately and review systems for unauthorized access.
Jul 14, 2026
A high-severity flaw tracked as **CVE-2026-54574** affects **Termux `proot-distro`** versions earlier than **5.1.5**, allowing a malicious archive to escape the intended extraction directory and write files to arbitrary locations on the host filesystem. The bug lies in `proot-distro`'s handling of plain tarball root filesystems and Docker layers during operations such as **`proot-distro install`** and **`proot-distro restore`**, where archive-controlled symbolic links were not safely validated before subsequent files were extracted through them. The vulnerability arises because lexical path traversal checks did not account for filesystem state changes after a symlink was created, enabling an attacker to craft an archive that first creates a symlink to an absolute host path and then writes a later file through that link. Reported impact includes possible writes to sensitive files such as `/etc/shadow` or files in a Termux home directory, with the issue classified as **CWE-61** and scored **CVSS 7.1** (`AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N`). The issue was fixed in **`proot-distro` 5.1.5**, including a safer extraction approach using `_safe_resolve()` in `proot_distro/helpers/tar_extract.py`.
Jul 30, 2026