Termix Docker Image Leaking SSH Credentials (CVE-2025-59951)

Termix’s official Docker image has a critical vulnerability (CVE-2025-59951) that exposes SSH credentials stored by the service. The flaw lets anyone with network access call the /ssh/db/host/internal endpoint and retrieve SSH host details, including credentials, without logging in. Termix runs a Node.js backend behind an Nginx reverse proxy, and because req[.]ip can return the proxy’s IP (127.0.0[.]1) when both components share the same environment, the application treats every request as coming from localhost.

The affected releases span release-0.1.1-tag through release-1.6.0-tag, with no patched version available at the time of writing, and the issue affects installations using the official image or custom images built from its Dockerfile if an Nginx reverse proxy with default settings is used, according to Security Researchers.

Mitigations include validating IPs with the X-Real-IP header, restricting access to management endpoints with firewalls, placing Termix behind an authenticated gateway or VPN, monitoring for unexpected /ssh/db/host/internal requests, and rotating any exposed SSH credentials.