EUVD-2026-36064Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionNVD
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no publicly available patches.
Articles & Coverage 1
AnalysisAI
Authentication bypass in Roxy-WI versions 8.2.6.4 and prior allows remote unauthenticated attackers to reach protected API functionality by including the 'api' substring in the URL, with the /api/gpt endpoint specifically exposed without authentication. The flaw carries a CVSS 8.3 with scope change and affects a web management interface for HAProxy, Nginx, Apache, and Keepalived, and no public exploit has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the Roxy-WI web interface on a vulnerable instance (version 8.2.6.4 or earlier) and the ability to issue an HTTP request whose URL either contains the substring 'api' (triggering the authentication-bypass code path) or targets the /api/gpt endpoint (which is unauthenticated by design). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:N/AC:L/PR:N/UI:N indicates fully remote, low-complexity, unauthenticated exploitation, which is the worst-case combination for an exposed management UI; scope is changed (S:C) reflecting that bypassing auth in the UI lets the attacker reach functionality belonging to a different security authority (the managed proxy/LB infrastructure). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach a Roxy-WI instance over the network sends an unauthenticated HTTP request to /api/gpt (or another URL crafted to contain the 'api' substring) and obtains access to API functionality that should require an authenticated session, allowing interaction with the management plane of the underlying HAProxy/Nginx/Apache/Keepalived servers. Because the attack is network-based, low-complexity, and requires no privileges or user interaction, opportunistic mass scanning for Roxy-WI instances is plausible once the bypass URL pattern is widely known. … |
| Remediation | No vendor-released patch identified at time of analysis, so administrators must rely on compensating controls until an updated Roxy-WI release is published via the GHSA-4fcm-qgg8-w2vf advisory at https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-4fcm-qgg8-w2vf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit Roxy-WI logs for unauthorized /api/gpt and /api endpoint access; inventory all internet-exposed Roxy-WI instances and prioritize by infrastructure criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Privilege escalation and cross-tenant compromise in Roxy-WI versions 8.2.6.4 and prior allows any authenticated user - i
Remote code execution in Roxy-WI versions 8.2.6.4 and prior allows authenticated users to write attacker-controlled cont
Remote code execution in Roxy-WI versions 8.2.6.4 and prior allows authenticated low-privilege users (role ≤ 3) to injec
Cross-tenant data tampering in Roxy-WI versions 8.2.6.4 and prior allows any authenticated user to silently overwrite HT
Authenticated command injection in Roxy-WI versions 8.2.6.4 and prior allows low-privileged users (role <= 3, 'user') to
Share
External POC / Exploit Code
Leaving vuln.today