CVE-2026-42454: Termix: OS Command Injection in Docker Container Management Endpoints

Overview

CVE-2026-42454 affects Termix, a web-based server management platform with SSH terminal, tunneling and file editing features. According to the record, the Docker container management endpoints build shell commands from the containerId path parameter and a WebSocket message field without sanitization or validation. This matches the OS command injection class (CWE-78).

Impact

• The record states that an authenticated attacker can run arbitrary OS commands and achieve remote code execution on any managed server.
• The CVSS 3.1 vector reports network attack vector, low complexity, low privileges required, no user interaction, scope change, and high confidentiality, integrity and availability impact.
• Because the affected component manages remote servers, a successful attack could extend beyond the Termix host to the servers it controls (inference from the scope change in the record).

Affected products and versions

• Termix-SSH Termix, versions below 2.1.0.
• The record's fixes list is empty. The fix in version 2.1.0 is taken from the description and the linked release tag.

Exploitation status

• The CISA KEV catalogue does not list this CVE in the record.
• The SSVC fields report exploitation as none and automatable as no.
• The EPSS probability is 0.85 percent, at about the 57th percentile.
• No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

• Upgrade Termix to version 2.1.0 or later, as stated in the advisory and release notes.
• Limit access to the Termix web interface to trusted users and networks, and review which accounts can manage Docker containers through it.
• Apply least privilege to the SSH accounts that Termix uses on managed servers.
• Review whether managed servers should remain reachable through Termix until the upgrade is complete.

Detection guidance

• Review Termix application logs for container management requests that contain unusual or non-standard container identifiers.
• Review SSH and system logs on managed servers for commands that do not match expected Docker management activity.
• Monitor for new or unexpected accounts and sessions created through Termix.

Limitations of the available information

• The record does not describe the exact vulnerable requests or the affected code paths beyond the summary.
• The fixes list is empty, so the fixed version relies on the description and release reference.
• The EPSS date in the record is later than the publication date, and the record does not explain this.
• No additional advisories or independent technical analyses were included in the record.

Frequently asked questions

Which Termix versions are affected by CVE-2026-42454?

The record lists Termix-SSH Termix versions below 2.1.0 as affected. The advisory states the issue is patched in version 2.1.0.

Is CVE-2026-42454 known to be actively exploited?

No. The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do first?

Upgrade Termix to version 2.1.0 or later, restrict access to its web interface to trusted users, and review logs on managed servers for unexpected activity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.