Termix and a Red Hat AI Gateway: Two Critical CVEs Where an Ordinary Account Breaks Out

Two critical CVEs published in the past few days look unrelated at first. One affects Termix, an SSH server management tool. The other affects ai-gateway-payload-processing, an LLM gateway component tracked by Red Hat. Their CVSS vectors tell the same story, though: PR:L (an ordinary account is enough) and S:C (the impact reaches beyond the vulnerable component). In both cases, a legitimate user gets out of the boundary the application is supposed to enforce.

Neither is in the CISA KEV catalog at the time of writing.

Termix: CVE-2026-120322

The bug sits in the /plugin-api/file-manager/transferToHost API endpoint used by the file manager. The destPath parameter is not validated: by adding directory traversal sequences, an authenticated user can have a file written wherever they choose. The title of the referenced report calls it an arbitrary file write.

VulDB, the CNA for this CVE, scores it 9.9 in CVSS 3.1 and 8.6 in CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P). The description states that the exploit is public.

Why this matters: an SSH management tool is a trusted machine by design, holding access to other servers. Being able to drop a file at a chosen location opens the way, depending on what the process can write, to code execution or configuration tampering. That is an inference, not a scenario spelled out in the NVD entry.

Fix. According to the description, the shortcut at fault was removed in the standalone File Manager plugin v1.0.0 (the transfer engine now always writes over SFTP) and in core v26.10.0. It also notes that the vendor, contacted before disclosure, never replied to VulDB. NVD has no CPE configuration, so check your installed version against the project's repository.

Red Hat ai-gateway-payload-processing: CVE-2026-117574

This component processes requests for an LLM gateway shared by several tenants. The NVD description lays out the mechanism:

1. an authenticated attacker sends a request naming another tenant's model identifier, in the body or in a header;
2. the service fetches the matching credentials from a shared secret store without checking that the requester is entitled to them;
3. it injects the target tenant's API keys into the request.

The attacker ends up consuming another customer's LLM resources and quotas, on that customer's bill. Red Hat scores it 9.1 (C:H/I:L/A:L). The C:H reflects the use of someone else's keys; the description does not say the keys themselves are returned to the attacker.

It is a textbook CWE-639 case: the application trusts a client-supplied identifier to decide which data the client gets. The risk family is the same as in the LiteLLM flaw added to KEV in May, exposure of LLM provider keys, through a different mechanism.

Versions. NVD lists no affected Red Hat product, no version and no fix: the record is still awaiting analysis. The only references are Red Hat's CVE page and Bugzilla entry 2494861. Check Red Hat's CVE page to learn which products ship this component and which release fixes it.

Detection

Termix

• Find your instances and their versions (core and File Manager plugin).
• In HTTP logs, look for calls to /plugin-api/file-manager/transferToHost where destPath contains ../ or an absolute path outside the expected directories.
• Review recently modified files on the host, especially outside the usual transfer directories.

AI gateway

• Compare token usage and per-model calls by tenant: a tenant using a model that is not theirs is the direct signal.
• If the gateway logs keep both the requested model identifier and the authenticated tenant, look for requests where the two do not match.

Mitigation

1. Termix: move to core v26.10.0 or later, or to the standalone File Manager plugin v1.0.0. Until then, restrict the interface to administrators only, behind a VPN.
2. Termix: reduce the process's rights on the host to limit what an arbitrary write can reach.
3. AI gateway: apply the fix as soon as Red Hat ships it for your product. Meanwhile, cap per-tenant quotas and watch your LLM provider billing.
4. AI gateway: if you suspect abuse, rotate the affected tenants' API keys.

Why continuous monitoring of admin tools and AI components matters

Neither CVE has a CPE configuration yet, so monitoring limited to CPE matching will not flag them. Admin tools and AI components often get installed outside the official inventory, which makes them all the easier to forget.

With cveo.tech, add them to your inventory with their version and get an alert as soon as a CVE names them, even before NVD analysis.