CVE-2026-45566
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the login flow improperly handles URLs, allowing for an open redirect attack.
Risk Assessment
An attacker could exploit this vulnerability to redirect users to malicious sites, potentially leading to data theft or malware. Organizations should be aware of the risks associated with unauthorized access to their systems.
Recommendation
It is recommended to update Roxy-WI to the latest version as soon as patches become available. Additionally, implementing extra URL validation mechanisms in the login process is advisable.
Other vulnerabilities in Roxy-WI
See all- CVE-2026-45558Critical
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints accept an unvalidated JSON option field, allowing arbitrary HAProxy directives to be injected into the configuration.
- CVE-2026-45556Critical
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the config_file_name field in the POST request /waf/<service>/<server_ip>/rule/<rule_id>/save is not properly validated, allowing an attacker to write files to any location on the load balancer's filesystem.
- CVE-2026-45552Critical
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the lack of proper decorators in certain endpoints allows any logged-in user, including the default guest role, to install and reconfigure exporters, WAF, and GeoIP databases on all servers in the Roxy-WI database.
- CVE-2026-45550Critical
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the PUT /smon/check functionality does not verify if the check_id belongs to the user's group, allowing unauthorized modifications to other users' monitoring settings.
- CVE-2026-45569High
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, there is a vulnerability that allows bypassing security checks related to path validation, potentially leading to path traversal attacks.
- CVE-2026-45567High
Roxy-WI, a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers, has an authentication bypass vulnerability in versions 8.2.6.4 and prior. This vulnerability allows bypassing authentication via the 'api' substring in the URL and accessing the unauthenticated /api/gpt.
- CVE-2026-45565High
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the central Pydantic validator does not properly block metacharacters, allowing an attacker to inject unauthorized commands.
- CVE-2026-45564High
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the configver parameter in the URL path is interpolated without proper validation, leading to command injection vulnerabilities for authenticated users.
- CVE-2026-45563Medium
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the server_ip path parameter in GET /history/<service>/<server_ip> is reused as a user-id when service == 'user', with no authorization check.
- CVE-2026-45561Medium
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the /smon/agent/{version,uptime,status,checks}/<server_ip> family of routes takes the URL path component verbatim, which may lead to unauthorized access.
Original NVD description (English source)
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the login flow allow-lists next URLs by rejecting strings containing https:// or http:// substrings, then constructs https://{request.host}{next_url} and the JS client redirects via window.location.replace(). The block does not consider the userinfo@host syntax. [email protected]/path produces https://[email protected]/path, which all modern browsers route to evil.example. At time of publication, there are no publicly available patches.