EUVD-2026-36036Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Lifecycle Timeline
2DescriptionNVD
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, agent_action (app/routes/smon/agent_routes.py:166-179) has decorators @bp.post('/agent/action/<action>') and @jwt_required() only - no role check, no group ownership check on the server_ip form field. Any authenticated user, including role 4 (guest), can start, stop, or restart the roxy-wi-smon-agent systemd unit on any server they can name. Roxy-WI executes the systemd action over its own SSH credentials (passwordless sudo), so the action runs as root on the target. At time of publication, there are no publicly available patches.
Articles & Coverage 1
AnalysisAI
Privilege escalation in Roxy-WI versions 8.2.6.4 and prior allows any authenticated user - including the lowest-privilege 'guest' role 4 - to start, stop, or restart the roxy-wi-smon-agent systemd unit on arbitrary managed servers, with the action executing as root via Roxy-WI's passwordless sudo SSH credentials. The flaw stems from missing role and group-ownership checks on the agent_action endpoint, and no public exploit has been identified at time of analysis though the vulnerability is trivially reachable once an account exists.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a valid Roxy-WI account at any privilege level including the lowest 'guest' role 4, since the only enforced control is @jwt_required(); (2) network reachability to the Roxy-WI web interface and its /agent/action/<action> POST endpoint; and (3) knowledge or guessing of a target server_ip value that Roxy-WI manages. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H scores 8.5 and is consistent with the description: network-reachable endpoint, low complexity, only low privileges required (the guest role qualifies as PR:L), no user interaction, and a scope change because the vulnerable Roxy-WI authorization boundary is crossed to compromise downstream managed servers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An insider or attacker who has compromised any Roxy-WI account - even a guest with role 4 - authenticates to the web UI, obtains a JWT, and issues an HTTP POST to /agent/action/restart (or stop/start) with the server_ip form field set to a production HAProxy or Nginx host that the user has no legitimate authority over. Roxy-WI's backend opens its privileged SSH session to that target and runs systemctl as root, allowing the attacker to repeatedly stop the smon agent to blind monitoring or restart it to induce flapping and outages. … |
| Remediation | No vendor-released patch identified at time of analysis - the advisory explicitly states no public patches exist as of publication, so administrators should monitor https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-c92j-h72m-ff4j for a fixed release beyond 8.2.6.4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Roxy-WI deployments and document versions (vulnerable: ≤8.2.6.4); audit access logs for suspicious agent control commands on the agent_action endpoint. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Privilege escalation and cross-tenant compromise in Roxy-WI versions 8.2.6.4 and prior allows any authenticated user - i
Remote code execution in Roxy-WI versions 8.2.6.4 and prior allows authenticated users to write attacker-controlled cont
Remote code execution in Roxy-WI versions 8.2.6.4 and prior allows authenticated low-privilege users (role ≤ 3) to injec
Cross-tenant data tampering in Roxy-WI versions 8.2.6.4 and prior allows any authenticated user to silently overwrite HT
Authenticated command injection in Roxy-WI versions 8.2.6.4 and prior allows low-privileged users (role <= 3, 'user') to
Share
External POC / Exploit Code
Leaving vuln.today