What is the CVSS score of CVE-2026-45558?

CVE-2026-45558 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Roxy-WI are affected by CVE-2026-45558?

Roxy-WI versions 8.2.6.4 and prior contain a critical remote code execution vulnerability (CVE-2026-45558, CVSS 9.9) that allows authenticated low-privilege users to inject arbitrary HAProxy…

How to fix or mitigate CVE-2026-45558?

Within 24 hours: Inventory all Roxy-WI deployments and current version numbers; audit which users have low-privilege roles (≤3) with API access; implement immediate network access controls restricting API calls to section-save endpoints to trusted administrator sources only. Within 7 days: Deploy centralized logging and alerting on HAProxy configuration changes via Roxy-WI APIs; conduct access review and reduce low-privilege user accounts to absolute minimum; document all current HAProxy configurations as baseline. Within 30 days: Establish daily monitoring for vendor security updates and patch availability; develop and test upgrade strategy for all Roxy-WI instances; evaluate alternative load balancer management solutions if patches remain unavailable.

Roxy-WI CVE-2026-45558

EUVD-2026-36039 CRITICAL

Improper Input Validation (CWE-20)

2026-06-10 GitHub_M

RCE Apache Nginx Roxy Wi

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 15:16 vuln.today

CVE Published

Jun 10, 2026 - 14:01 nvd

CRITICAL 9.9

DescriptionNVD

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy/<server_id>/section/<section_type> and the PUT / global / defaults variants) accept a JSON option field that is not validated, not escaped, and is rendered verbatim into the generated HAProxy configuration via the section.j2, global.j2, and defaults.j2 Ansible templates. Because Roxy-WI then pushes the generated config to the load balancer and runs systemctl reload haproxy, an authenticated user with role ≤ 3 (user) can inject arbitrary HAProxy directives into the config that runs on every load balancer their group manages - including option external-check + external-check command /bin/bash -c '…', which gives remote code execution on the load balancer as the haproxy user on every health-check tick. At time of publication, there are no publicly available patches.

Articles & Coverage 4

News 9 New Nginx Vulnerabilities - 4 Critical, 5 High Severity Patched Jun 11, 2026 News 12 New Apache Vulnerabilities - 6 Critical, 6 High Severity Jun 11, 2026 News 11 New Apache Vulnerabilities - 4 Critical, 7 High Severity Jun 10, 2026 News Critical RCE in Roxy-WI (Nginx) 8.2.6.4 - CVE-2026-45558 Jun 10, 2026

AnalysisAI

Remote code execution in Roxy-WI versions 8.2.6.4 and prior allows authenticated low-privilege users (role ≤ 3) to inject arbitrary HAProxy directives via unvalidated JSON option fields in the HAProxy section-save API endpoints, achieving command execution as the haproxy user on every managed load balancer. No public exploit has been identified at time of analysis, but the attack is straightforward given the documented injection path through the section.j2, global.j2, and defaults.j2 Ansible templates, and no vendor-released patch is available.

Technical ContextAI

Roxy-WI is a Python/Flask-based web interface that orchestrates HAProxy, Nginx, Apache, and Keepalived configurations and pushes them to managed nodes via Ansible templates. The vulnerability is a CWE-20 Improper Input Validation flaw: the option field accepted by POST /api/service/haproxy/<server_id>/section/<section_type> and the PUT global/defaults variants is rendered verbatim into HAProxy configuration files through Jinja2 templates without escaping. Because HAProxy supports the option external-check directive paired with external-check command, which executes a shell command on every health-check tick, injecting these directives turns a config-injection bug into reliable code execution on the load balancer host. The affected CPE is cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:* covering all versions up to and including 8.2.6.4.

RemediationAI

No vendor-released patch is identified at time of analysis - the GHSA-w2x4-66jj-3597 advisory explicitly states no public patches exist. Until a fixed release ships, restrict access to the Roxy-WI management interface to a trusted administrator network only (VPN or bastion), audit and remove any role ≤ 3 (user) accounts that do not strictly require HAProxy section editing, and consider temporarily disabling the section-save API endpoints (POST /api/service/haproxy/<server_id>/section/<section_type> and the PUT global/defaults variants) at a reverse proxy layer if your workflow allows - the trade-off is that legitimate users will lose the ability to edit HAProxy sections through the UI. As a detective control, monitor generated haproxy.cfg files on managed load balancers for unexpected external-check or external-check command directives, and watch for shells spawned by the haproxy user. Track the GHSA advisory at https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-w2x4-66jj-3597 for the patched version announcement.