Critical Flaw in Termix Docker Image (CVE-2025-59951) Leaks SSH Credentials Without Authentication

The Termix project has disclosed a critical authentication bypass in its official Docker image, exposing sensitive SSH configuration data without requiring user login, tracked as CVE-2025-59951 with a CVSS v4 score of 9.2. Termix is an open-source, forever-free, self-hosted all-in-one server management platform, offering SSH terminal access and remote file management, among other features.

The vulnerability stems from how the backend interprets client IP addresses when running behind an Nginx reverse proxy, causing isLocalhost to always return True and making the /ssh/db/host/internal endpoint accessible without authentication. According to the Termix advisory, users who use the official Termix docker image, build their own image using the official dockerfile, or utilise reverse proxy functionality will be affected.

Affected versions are release-0.1.1-tag through release-1.6.0-tag, with a patched version available in release-1.7.0-tag, and a proof-of-concept exploit demonstrates how easily the endpoint can be accessed to retrieve SSH host details.