CVE-2026-45559
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the get_ldap_email function builds the LDAP search filter via f-string concatenation, allowing for the injection of additional clauses through improperly processed username URL path parameters.
Risk Assessment
An attacker can exploit this vulnerability to enumerate or harvest attributes outside the intended record, potentially leading to the disclosure of sensitive information. The lack of publicly available patches increases the risk for organizations.
Recommendation
It is recommended to upgrade to the latest version of Roxy-WI as soon as patches become available. Additionally, consider implementing extra security measures such as input validation and escaping user input.
Other vulnerabilities in Roxy-WI
See all- CVE-2026-45558Critical
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints accept an unvalidated JSON option field, allowing arbitrary HAProxy directives to be injected into the configuration.
- CVE-2026-45556Critical
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the config_file_name field in the POST request /waf/<service>/<server_ip>/rule/<rule_id>/save is not properly validated, allowing an attacker to write files to any location on the load balancer's filesystem.
- CVE-2026-45552Critical
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the lack of proper decorators in certain endpoints allows any logged-in user, including the default guest role, to install and reconfigure exporters, WAF, and GeoIP databases on all servers in the Roxy-WI database.
- CVE-2026-45550Critical
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the PUT /smon/check functionality does not verify if the check_id belongs to the user's group, allowing unauthorized modifications to other users' monitoring settings.
- CVE-2026-45569High
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, there is a vulnerability that allows bypassing security checks related to path validation, potentially leading to path traversal attacks.
- CVE-2026-45567High
Roxy-WI, a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers, has an authentication bypass vulnerability in versions 8.2.6.4 and prior. This vulnerability allows bypassing authentication via the 'api' substring in the URL and accessing the unauthenticated /api/gpt.
- CVE-2026-45566Medium
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the login flow improperly handles URLs, allowing for an open redirect attack.
- CVE-2026-45565High
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the central Pydantic validator does not properly block metacharacters, allowing an attacker to inject unauthorized commands.
- CVE-2026-45564High
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the configver parameter in the URL path is interpolated without proper validation, leading to command injection vulnerabilities for authenticated users.
- CVE-2026-45563Medium
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the server_ip path parameter in GET /history/<service>/<server_ip> is reused as a user-id when service == 'user', with no authorization check.
Original NVD description (English source)
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, get_ldap_email (app/modules/roxywi/user.py:120-157) builds the LDAP search filter via f-string concatenation. The username URL path parameter is taken verbatim — no checkAjaxInput, no LDAP escape — and inserted, a username like *)(mail=*)(cn=* injects additional clauses, allowing the admin to enumerate or harvest attributes outside the intended record. At time of publication, there are no publicly available patches.