What is the CVSS score of CVE-2026-45549?

CVE-2026-45549 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of Roxy-WI are affected by CVE-2026-45549?

Roxy-WI versions 8.2.6.4 and earlier contain a privilege escalation vulnerability that allows users with platform access to execute administrative commands as root on any managed server.

How to fix or mitigate CVE-2026-45549?

Within 24 hours: Identify all Roxy-WI deployments and document versions (vulnerable: ≤8.2.6.4); audit access logs for suspicious agent control commands on the agent_action endpoint. Within 7 days: Contact Roxy-WI vendor requesting patch status; restrict Roxy-WI console access to named administrators; disable or remove guest-role accounts. Within 30 days: Apply vendor-released patch immediately upon availability; rotate SSH credentials on all managed servers; if no patch is released by day 30, implement network segmentation isolating Roxy-WI from managed infrastructure.

Roxy-WI CVE-2026-45549

EUVD-2026-36036 HIGH

Missing Authorization (CWE-862)

2026-06-10 GitHub_M

Authentication Bypass Apache Nginx Roxy Wi

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 15:12 vuln.today

CVE Published

Jun 10, 2026 - 13:59 nvd

HIGH 8.5

DescriptionNVD

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, agent_action (app/routes/smon/agent_routes.py:166-179) has decorators @bp.post('/agent/action/<action>') and @jwt_required() only - no role check, no group ownership check on the server_ip form field. Any authenticated user, including role 4 (guest), can start, stop, or restart the roxy-wi-smon-agent systemd unit on any server they can name. Roxy-WI executes the systemd action over its own SSH credentials (passwordless sudo), so the action runs as root on the target. At time of publication, there are no publicly available patches.

Articles & Coverage 3

News 9 New Nginx Vulnerabilities - 4 Critical, 5 High Severity Patched Jun 11, 2026 News 12 New Apache Vulnerabilities - 6 Critical, 6 High Severity Jun 11, 2026 News 11 New Apache Vulnerabilities - 4 Critical, 7 High Severity Jun 10, 2026

AnalysisAI

Privilege escalation in Roxy-WI versions 8.2.6.4 and prior allows any authenticated user - including the lowest-privilege 'guest' role 4 - to start, stop, or restart the roxy-wi-smon-agent systemd unit on arbitrary managed servers, with the action executing as root via Roxy-WI's passwordless sudo SSH credentials. The flaw stems from missing role and group-ownership checks on the agent_action endpoint, and no public exploit has been identified at time of analysis though the vulnerability is trivially reachable once an account exists.

Technical ContextAI

Roxy-WI is a Python/Flask-based web interface (cpe:2.3:a:roxy-wi:roxy-wi) for centrally managing HAProxy, Nginx, Apache, and Keepalived deployments. The defect lives in app/routes/smon/agent_routes.py at lines 166-179, where the agent_action handler is decorated only with @bp.post('/agent/action/<action>') and @jwt_required(), meaning a valid JWT is the sole gate. The root cause is CWE-862 (Missing Authorization): neither a role-based access check nor a group-ownership check on the user-supplied server_ip form field is performed before the request is dispatched. Because Roxy-WI fans out the resulting systemd command over its own SSH session - which is configured with passwordless sudo on every managed host - the action ultimately executes with full root privileges on whichever target IP the attacker names.

RemediationAI

No vendor-released patch identified at time of analysis - the advisory explicitly states no public patches exist as of publication, so administrators should monitor https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-c92j-h72m-ff4j for a fixed release beyond 8.2.6.4. As compensating controls, restrict Roxy-WI account creation strictly to trusted operators and audit existing role 4 (guest) accounts for removal or downgrade - the side effect is loss of read-only visibility for less-trusted staff. Place the Roxy-WI web interface behind a VPN or IP allowlist so the /agent/action/<action> endpoint cannot be reached from untrusted networks (side effect: remote operators must connect via VPN). Where feasible, tighten the SSH key Roxy-WI uses to manage targets by replacing passwordless sudo with a sudoers entry that whitelists only the specific systemctl commands actually required, limiting the blast radius if the endpoint is abused (side effect: any new Roxy-WI features needing additional sudo commands will fail until sudoers is updated). Finally, monitor systemd journal entries for unexpected roxy-wi-smon-agent start/stop/restart events as a detective control.