CVE-2026-45549 Details
Description
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, agent_action (app/routes/smon/agent_routes.py:166-179) has decorators @bp.post('/agent/action/<action>') and @jwt_required() only — no role check, no group ownership check on the server_ip form field. Any authenticated user, including role 4 (guest), can start, stop, or restart the roxy-wi-smon-agent systemd unit on any server they can name. Roxy-WI executes the systemd action over its own SSH credentials (passwordless sudo), so the action runs as root on the target. At time of publication, there are no publicly available patches.
An authorization bypass vulnerability has been identified in Roxy-WI versions through 8.2.6.4. The issue resides in the 'agent_action' route, which is decorated with '@bp.post('/agent/action/<action>')' and '@jwt_required()'. However, it lacks role verification and group ownership checks on the 'server_ip' form field. This oversight enables any authenticated user, including those with guest roles, to start, stop, or restart the 'roxy-wi-smon-agent' systemd unit on any specified server. The actions are executed using Roxy-WI's SSH credentials with passwordless sudo, allowing the commands to run as root on the target server.
As of now, there are no publicly available patches for this vulnerability. However, the Roxy-WI team has acknowledged the issue and is working on a fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 10, 2026CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-c92j-h72m-ff4j | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-c92j-h72m-ff4j | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Roxy-WI | <= 8.2.6.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |