What is the CVSS score of CVE-2026-45567?

CVE-2026-45567 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Roxy-WI are affected by CVE-2026-45567?

Roxy-WI versions 8.2.6.4 and earlier contain an authentication bypass allowing unauthenticated remote attackers to access protected API endpoints and administrative functionality for critical…

How to fix or mitigate CVE-2026-45567?

Within 24 hours: Audit Roxy-WI logs for unauthorized /api/gpt and /api endpoint access; inventory all internet-exposed Roxy-WI instances and prioritize by infrastructure criticality. Within 7 days: Implement network segmentation restricting administrative interface access to trusted networks only; deploy WAF rules blocking external requests to /api endpoints; enforce VPN or bastion host requirement for administrative access. Within 30 days: Monitor vendor security advisories for patch release; plan and schedule upgrade to Roxy-WI patched version upon vendor release.

Roxy-WI CVE-2026-45567

EUVD-2026-36064 HIGH

Improper Authentication (CWE-287)

2026-06-10 GitHub_M

Authentication Bypass Apache Nginx Roxy Wi

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 16:24 vuln.today

CVE Published

Jun 10, 2026 - 15:37 nvd

HIGH 8.3

DescriptionNVD

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no publicly available patches.

Articles & Coverage 3

News 9 New Nginx Vulnerabilities - 4 Critical, 5 High Severity Patched Jun 11, 2026 News 12 New Apache Vulnerabilities - 6 Critical, 6 High Severity Jun 11, 2026 News 11 New Apache Vulnerabilities - 4 Critical, 7 High Severity Jun 10, 2026

AnalysisAI

Authentication bypass in Roxy-WI versions 8.2.6.4 and prior allows remote unauthenticated attackers to reach protected API functionality by including the 'api' substring in the URL, with the /api/gpt endpoint specifically exposed without authentication. The flaw carries a CVSS 8.3 with scope change and affects a web management interface for HAProxy, Nginx, Apache, and Keepalived, and no public exploit has been identified at time of analysis. No vendor-released patch exists at time of publication, making this a high-priority issue for any internet-exposed installation.

Technical ContextAI

Roxy-WI is a Python/Flask-based web interface used to manage and monitor proxy and load-balancer software including HAProxy, Nginx, Apache, and Keepalived. The root cause is CWE-287 (Improper Authentication): the authentication middleware appears to use a substring or prefix check against the request path rather than a strict route match, so any URL containing 'api' is treated as belonging to a path that bypasses session enforcement. Compounding this, the /api/gpt endpoint is itself defined without an authentication requirement. The CPE cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:* indicates the entire product line up to 8.2.6.4 is affected.

RemediationAI

No vendor-released patch identified at time of analysis, so administrators must rely on compensating controls until an updated Roxy-WI release is published via the GHSA-4fcm-qgg8-w2vf advisory at https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-4fcm-qgg8-w2vf. Immediate compensating controls include restricting network access to the Roxy-WI web interface using a firewall or reverse-proxy ACL to allow only trusted management IP ranges, which removes remote unauthenticated reachability at the cost of breaking access for any legitimate remote operators who are not on the allowlist. As a defense-in-depth layer, place Roxy-WI behind an authenticating reverse proxy (for example nginx with basic-auth or mTLS, or an SSO/OAuth proxy such as oauth2-proxy) so that requests to any path including /api/gpt and any URL containing 'api' are rejected before reaching the vulnerable application, accepting the trade-off of an additional auth layer for operators to manage. Specifically blocking external requests to /api/* on the upstream proxy is a narrower mitigation but will break legitimate API automation; combine with monitoring of access logs for unexpected /api/gpt requests.