CVE-2026-45550: Roxy-WI SQL Injection Vulnerability

CVE-2026-45550 Overview

CVE-2026-45550 is an Insecure Direct Object Reference (IDOR) vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw affects versions 8.2.6.4 and prior. The PUT /smon/check endpoint validates only that the caller belongs to some group, not that the target check_id belongs to the caller's tenant. Any authenticated user can rewrite HTTP, TCP, Ping, or DNS monitoring checks owned by other tenants. The issue is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Authenticated users across tenants can silently modify any other tenant's SMON monitoring checks, breaking integrity of monitoring data with no public patch available at publication.

Affected Products

Roxy-WI versions 8.2.6.4 and prior
Roxy-WI SMON (Simple Monitoring) component
Deployments exposing the PUT /smon/check route to multi-tenant authenticated users

Discovery Timeline

2026-06-10 - CVE-2026-45550 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45550

Vulnerability Analysis

The vulnerability resides in the SMON update route handler at app/routes/smon/routes.py:117-138. The handler enforces authorization through roxywi_common.check_user_group_for_flask(), which confirms only that the authenticated user is a member of some group. The check does not verify ownership of the check_id supplied in the request body.

Downstream database update functions in app/modules/db/smon.py:515-562 — including update_smon, update_smonHttp, update_smonTcp, update_smonPing, and update_smonDns — execute SQL statements using WHERE smon_id = ? without any user_group filter. Because the identifier space is enumerable, an attacker iterates over smon_id values and overwrites monitoring configurations belonging to other tenants.

The corresponding DELETE path at app/modules/db/smon.py:319-327 correctly enforces WHERE id = ? AND user_group = ?. This inconsistency confirms the maintainers know the proper isolation pattern but failed to apply it on UPDATE operations.

Root Cause

The root cause is missing tenant ownership validation on the update query path. Authorization is enforced at the route level for session validity only, while the data access layer assumes the caller has already been confirmed as the resource owner. No layer applies the tenant scope.

Attack Vector

An attacker authenticates as any low-privileged Roxy-WI user. The attacker sends PUT /smon/check requests with arbitrary smon_id values and modified check parameters such as target host, port, expected response, or check interval. The server executes the update against records belonging to other tenants. The attack requires only network access to the Roxy-WI interface and valid low-privilege credentials. The vulnerability does not enable code execution, but it compromises monitoring integrity and may be used to suppress alerts during subsequent intrusions.

No verified proof-of-concept code is published. See the GitHub Security Advisory GHSA-856h-mvm2-2h2x for the maintainer's technical writeup.

Detection Methods for CVE-2026-45550

Indicators of Compromise

Unexpected modifications to SMON check definitions (target host, port, interval, expected status) without a corresponding change ticket
Application audit log entries showing PUT /smon/check requests from user accounts that do not own the referenced smon_id
Sudden silencing or flapping of previously stable HTTP, TCP, Ping, or DNS monitoring checks
Repeated sequential smon_id values appearing in update requests from a single session, indicating enumeration

Detection Strategies

Parse Roxy-WI application logs and correlate the authenticated user's user_group against the user_group of the smon_id being updated; flag mismatches
Add database-level triggers or audit logging on the smon tables to record the acting user and the previous values on every UPDATE
Baseline normal SMON configuration change frequency per user and alert on volumetric anomalies

Monitoring Recommendations

Forward Roxy-WI access logs and database audit trails to a centralized log platform for cross-tenant correlation
Alert on PUT /smon/check requests where the response status is 200 but the smon_id does not map to the caller's group
Monitor for downstream effects such as monitoring checks pointing to attacker-controlled endpoints or returning falsified healthy states

How to Mitigate CVE-2026-45550

Immediate Actions Required

Restrict network access to the Roxy-WI web interface to trusted administrators using firewall rules or a VPN until a patch is released
Audit existing SMON check definitions across all tenants to confirm none have been tampered with
Reduce the number of authenticated low-privilege accounts and rotate credentials for any shared accounts
Track the upstream GHSA-856h-mvm2-2h2x advisory for patch availability

Patch Information

At the time of publication, no official patch is available from the Roxy-WI maintainers. Operators should monitor the Roxy-WI GitHub repository and the associated security advisory for fix releases. The expected remediation pattern is to add a user_group filter to each of the update_smon, update_smonHttp, update_smonTcp, update_smonPing, and update_smonDns queries, mirroring the existing DELETE path implementation.

Workarounds

Operate Roxy-WI as a single-tenant deployment and disable shared multi-tenant access until a fix is published
Place the application behind a reverse proxy that enforces method-level access control on /smon/check for non-administrative users
Apply a local patch that adds AND user_group = ? to the affected UPDATE statements in app/modules/db/smon.py
Implement read-only credentials for non-administrative users where possible to remove their ability to invoke UPDATE endpoints

bash

# Example reverse proxy restriction (nginx) to block PUT /smon/check for non-admin source IPs
location = /smon/check {
    limit_except GET POST DELETE { deny all; }
    proxy_pass http://roxy-wi-backend;
}