EUVD-2026-36064Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionNVD
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no publicly available patches.
Articles & Coverage 3
AnalysisAI
Authentication bypass in Roxy-WI versions 8.2.6.4 and prior allows remote unauthenticated attackers to reach protected API functionality by including the 'api' substring in the URL, with the /api/gpt endpoint specifically exposed without authentication. The flaw carries a CVSS 8.3 with scope change and affects a web management interface for HAProxy, Nginx, Apache, and Keepalived, and no public exploit has been identified at time of analysis. No vendor-released patch exists at time of publication, making this a high-priority issue for any internet-exposed installation.
Technical ContextAI
Roxy-WI is a Python/Flask-based web interface used to manage and monitor proxy and load-balancer software including HAProxy, Nginx, Apache, and Keepalived. The root cause is CWE-287 (Improper Authentication): the authentication middleware appears to use a substring or prefix check against the request path rather than a strict route match, so any URL containing 'api' is treated as belonging to a path that bypasses session enforcement. Compounding this, the /api/gpt endpoint is itself defined without an authentication requirement. The CPE cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:* indicates the entire product line up to 8.2.6.4 is affected.
RemediationAI
No vendor-released patch identified at time of analysis, so administrators must rely on compensating controls until an updated Roxy-WI release is published via the GHSA-4fcm-qgg8-w2vf advisory at https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-4fcm-qgg8-w2vf. Immediate compensating controls include restricting network access to the Roxy-WI web interface using a firewall or reverse-proxy ACL to allow only trusted management IP ranges, which removes remote unauthenticated reachability at the cost of breaking access for any legitimate remote operators who are not on the allowlist. As a defense-in-depth layer, place Roxy-WI behind an authenticating reverse proxy (for example nginx with basic-auth or mTLS, or an SSO/OAuth proxy such as oauth2-proxy) so that requests to any path including /api/gpt and any URL containing 'api' are rejected before reaching the vulnerable application, accepting the trade-off of an additional auth layer for operators to manage. Specifically blocking external requests to /api/* on the upstream proxy is a narrower mitigation but will break legitimate API automation; combine with monitoring of access logs for unexpected /api/gpt requests.
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today