Termix allows authenticated users to set webhook or ntfy notification channels with attacker-controlled URLs and triggers blind requests to internal HTTP services through a test endpoint. The request path bypasses destination allowlisting and private-address checks, enabling blind server‑side requests. In webhook mode, the attacker can also set HTTP methods and headers, potentially causing limited state changes if the internal service accepts the fixed notification body, although no response is returned. This can expose internal services, facilitate data exfiltration or lateral movement, but does not directly provide remote code execution.

The vulnerability affects Termix versions 2.5.0 through 2.5.1 released by Termix‑SSH. Version 2.5.1 includes a fix that removes the blind SSRF flaw.

With a CVSS score of 6.4 the flaw is moderately severe. The EPSS score is not available and the issue is not in the CISA KEV list. Exploitation requires valid authentication to Termix; the attacker can request internal services from the server but cannot retrieve response bodies. Attackers may leverage the blind SSRF to scan internal networks, cause side‑channel effects, or perform limited state changes, potentially aiding later-stage attacks.