CVE-2026-45549: Roxy-WI Privilege Escalation Vulnerability

CVE-2026-45549 Overview

CVE-2026-45549 is a missing authorization vulnerability [CWE-862] in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw affects versions 8.2.6.4 and prior. The agent_action route in app/routes/smon/agent_routes.py enforces only authentication through @jwt_required(), omitting role and group ownership checks on the server_ip form field. Any authenticated user, including the role 4 guest account, can start, stop, or restart the roxy-wi-smon-agent systemd unit on any server they can name. Roxy-WI executes the systemd action over its own SSH credentials with passwordless sudo, so the operation runs as root on the target host.

Critical Impact
Low-privileged authenticated users can stop or restart monitoring agents as root on any reachable server, enabling cross-tenant disruption of managed HAProxy, Nginx, Apache, and Keepalived infrastructure.

Affected Products

Roxy-WI versions 8.2.6.4 and prior
roxy-wi-smon-agent systemd unit on managed servers
Deployments using Roxy-WI for HAProxy, Nginx, Apache, or Keepalived management

Discovery Timeline

2026-06-10 - CVE-2026-45549 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45549

Vulnerability Analysis

The vulnerability resides in the agent_action handler defined at app/routes/smon/agent_routes.py:166-179. The route is registered with @bp.post('/agent/action/<action>') and protected only by @jwt_required(). No decorator or inline check validates the caller's role, and no logic verifies that the server_ip parameter belongs to a group the caller owns.

Roxy-WI assigns numeric roles to users, with role 4 representing the guest tier. Guest accounts can authenticate, obtain a JWT, and submit requests to this endpoint. The handler accepts an arbitrary server_ip value and an action such as start, stop, or restart, then dispatches the systemd command to the named server.

Dispatching occurs over the Roxy-WI service's own SSH key, configured with passwordless sudo on managed hosts. The systemd action therefore runs as root on the target, regardless of the requester's privilege inside Roxy-WI.

Root Cause

The root cause is broken access control [CWE-862]. The endpoint conflates authentication with authorization. Authenticating a JWT proves identity but does not establish that the user has rights over the supplied server_ip or that their role permits agent control actions.

Attack Vector

An attacker first authenticates to Roxy-WI with any valid account, including a guest account created through self-service or social engineering. The attacker then issues a POST request to /agent/action/stop (or start, restart) with a server_ip value naming any host managed by the Roxy-WI instance. The server executes the systemd command as root on the target. Repeated stop requests disable monitoring agents across the fleet and disrupt downstream health checks and alerting.

The vulnerability cannot be exploited without an account, but no special privileges, user interaction, or local access are required beyond authentication.

See the GitHub Security Advisory GHSA-c92j-h72m-ff4j for upstream technical detail.

Detection Methods for CVE-2026-45549

Indicators of Compromise

HTTP POST requests to /agent/action/start, /agent/action/stop, or /agent/action/restart originating from low-privileged or guest JWT subjects.
systemctl invocations targeting roxy-wi-smon-agent on managed servers initiated by the Roxy-WI service account outside scheduled maintenance windows.
Unexpected gaps in smon agent telemetry correlated with Roxy-WI API activity from non-administrative users.

Detection Strategies

Parse Roxy-WI web server access logs for requests matching POST /agent/action/<action> and join against JWT subject role metadata to flag non-admin callers.
Audit SSH session logs on managed hosts for sudo systemctl (start|stop|restart) roxy-wi-smon-agent events sourced from the Roxy-WI control node.
Alert when a single Roxy-WI user account triggers agent actions across multiple server groups within a short interval.

Monitoring Recommendations

Ship Roxy-WI application logs and managed-host syslog to a centralized SIEM for correlation across the control plane and data plane.
Track the up/down state of roxy-wi-smon-agent per host and treat unscheduled stops as security events, not operational ones.
Review JWT issuance logs for guest-tier tokens and limit lifetime until a patch is deployed.

How to Mitigate CVE-2026-45549

Immediate Actions Required

Restrict network access to the Roxy-WI web interface to trusted administrative networks until a patched release is available.
Disable or remove guest (role 4) and other low-privileged accounts that do not require interactive use.
Rotate JWT signing secrets to invalidate outstanding low-privileged tokens.
Review managed-host audit logs for unauthorized roxy-wi-smon-agent state changes.

Patch Information

At the time of publication, no fixed release is available from the Roxy-WI project. Monitor the GitHub Security Advisory GHSA-c92j-h72m-ff4j and the Roxy-WI release notes for an updated version that adds role and group ownership checks to the agent_action route.

Workarounds

Place Roxy-WI behind a reverse proxy that requires mutual TLS or an additional authentication layer before reaching /agent/action/*.
Apply a web application firewall rule that blocks requests to /agent/action/<action> from sessions belonging to non-administrator roles.
Tighten the Roxy-WI service account's sudoers entry on managed hosts to require explicit per-command allowlisting rather than blanket passwordless sudo.

bash

# Example nginx snippet blocking agent_action for non-admin sessions
location ~ ^/agent/action/ {
    if ($http_x_roxywi_role !~ ^[1-2]$) {
        return 403;
    }
    proxy_pass http://roxywi_upstream;
}