CVE-2026-45561
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the /smon/agent/{version,uptime,status,checks}/<server_ip> family of routes takes the URL path component verbatim, which may lead to unauthorized access.
Risk Assessment
The lack of constraints on IP address validation may allow attackers to access sensitive resources, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to the latest version of Roxy-WI and implement additional security measures to restrict access to the interface.
Other vulnerabilities in Roxy-WI
See all- CVE-2026-45558Critical
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints accept an unvalidated JSON option field, allowing arbitrary HAProxy directives to be injected into the configuration.
- CVE-2026-45556Critical
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the config_file_name field in the POST request /waf/<service>/<server_ip>/rule/<rule_id>/save is not properly validated, allowing an attacker to write files to any location on the load balancer's filesystem.
- CVE-2026-45552Critical
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the lack of proper decorators in certain endpoints allows any logged-in user, including the default guest role, to install and reconfigure exporters, WAF, and GeoIP databases on all servers in the Roxy-WI database.
- CVE-2026-45550Critical
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the PUT /smon/check functionality does not verify if the check_id belongs to the user's group, allowing unauthorized modifications to other users' monitoring settings.
- CVE-2026-45569High
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, there is a vulnerability that allows bypassing security checks related to path validation, potentially leading to path traversal attacks.
- CVE-2026-45567High
Roxy-WI, a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers, has an authentication bypass vulnerability in versions 8.2.6.4 and prior. This vulnerability allows bypassing authentication via the 'api' substring in the URL and accessing the unauthenticated /api/gpt.
- CVE-2026-45566Medium
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the login flow improperly handles URLs, allowing for an open redirect attack.
- CVE-2026-45565High
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the central Pydantic validator does not properly block metacharacters, allowing an attacker to inject unauthorized commands.
- CVE-2026-45564High
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the configver parameter in the URL path is interpolated without proper validation, leading to command injection vulnerabilities for authenticated users.
- CVE-2026-45563Medium
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the server_ip path parameter in GET /history/<service>/<server_ip> is reused as a user-id when service == 'user', with no authorization check.
Original NVD description (English source)
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the /smon/agent/{version,uptime,status,checks}/<server_ip> family of routes takes the URL path component verbatim into requests.get(f'http://{server_ip}:{agent_port}/...'). The path component is constrained only by Flask's default URL converter, which permits any value (including IPv4 literals like 169.254.169.254, RFC1918 ranges, and 127.0.0.1). At time of publication, there are no publicly available patches.