CVE-2026-45552: Roxy-WI Auth Bypass Vulnerability

CVE-2026-45552 Overview

Roxy-WI is a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. CVE-2026-45552 is a broken access control vulnerability [CWE-639] affecting Roxy-WI versions 8.2.6.4 and prior. The install blueprint enforces only @jwt_required() through bp.before_request, omitting both role-based and tenant-based authorization on several endpoints. Any authenticated user, including the default guest role 4, can install or reconfigure exporters, the Web Application Firewall (WAF), and GeoIP databases on every server registered in Roxy-WI. The playbooks execute through stored per-server SSH credentials with sudo rights, granting cross-tenant code execution. No patches are publicly available at time of publication.

Critical Impact
Authenticated low-privileged users can execute Ansible playbooks with sudo on any tenant's servers, leading to full host compromise across the Roxy-WI fleet.

Affected Products

Roxy-WI versions 8.2.6.4 and prior
Roxy-WI install blueprint (app/routes/install/routes.py)
Managed targets: HAProxy, Nginx, Apache, Keepalived servers provisioned through Roxy-WI

Discovery Timeline

2026-06-10 - CVE-2026-45552 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45552

Vulnerability Analysis

The install blueprint declares only bp.before_request → @jwt_required() at app/routes/install/routes.py:36-39. This guarantees a valid JSON Web Token (JWT) but performs no further authorization. The endpoints install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status are not wrapped in page_for_admin. They also fail to call roxywi_common.is_user_has_access_to_its_group(server_ip) or check_is_server_in_group(server_ip). Only the GET index endpoint install_monitoring enforces roxywi_auth.page_for_admin(level=2). The missing decorators eliminate role and tenant checks on the action endpoints.

Root Cause

The root cause is an Insecure Direct Object Reference [CWE-639] combined with missing function-level authorization. The application authenticates the caller but never verifies that the supplied server_ip belongs to the caller's tenant group, nor that the caller holds an administrative role. Any authenticated identity — including guest role 4 — satisfies the gate.

Attack Vector

An attacker authenticates to Roxy-WI with any valid account and issues install or reconfiguration requests targeting a server_ip owned by a different tenant. Roxy-WI dispatches Ansible playbooks using the per-server SSH credential the rightful owner provisioned with sudo. The playbook executes on the victim's host, allowing arbitrary configuration of exporters, WAF, and GeoIP components, which can be leveraged for full host compromise.

No verified proof-of-concept code is published. Refer to the GitHub Security Advisory GHSA-v3f8-g2v8-jq5h for technical details.

Detection Methods for CVE-2026-45552

Indicators of Compromise

Unexpected Ansible playbook executions originating from the Roxy-WI host targeting servers owned by other tenants.
New or modified Prometheus exporter, WAF, or GeoIP package installations on managed hosts without a corresponding change ticket.
HTTP requests to /install/exporter, /install/waf, /install/geoip, or /install/check_geoip from non-administrative Roxy-WI accounts.
Sudo command activity on managed servers initiated by the Roxy-WI SSH service account outside normal maintenance windows.

Detection Strategies

Review Roxy-WI application logs for install blueprint requests correlated against the user's role and group membership.
Compare server_ip parameters in install endpoint calls to the tenant ownership table to flag cross-tenant requests.
Alert on JWT-authenticated requests to install endpoints from accounts at role level 4 (guest).

Monitoring Recommendations

Forward Roxy-WI web and Ansible task logs to a central Security Information and Event Management (SIEM) platform for correlation.
Monitor SSH session activity from the Roxy-WI host with file integrity monitoring on managed servers' /etc and exporter directories.
Track changes to WAF rule sets and GeoIP database files as high-priority change events.

How to Mitigate CVE-2026-45552

Immediate Actions Required

Restrict network access to the Roxy-WI web interface to trusted administrative networks until a patch is released.
Disable or remove unused Roxy-WI accounts, particularly any guest role 4 accounts that are not strictly required.
Rotate the per-server SSH credentials stored in Roxy-WI and audit recent install endpoint activity for unauthorized invocations.
Segregate tenants onto separate Roxy-WI deployments where feasible to limit cross-tenant blast radius.

Patch Information

At time of publication, the maintainers have not released a public patch for Roxy-WI versions 8.2.6.4 and prior. Track the GitHub Security Advisory GHSA-v3f8-g2v8-jq5h for fix availability and upgrade to the patched release as soon as it is published.

Workarounds

Place Roxy-WI behind a reverse proxy that enforces additional authentication and IP allow-listing for the /install/* routes.
Apply a local patch that wraps install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status with page_for_admin(level=2) and a call to roxywi_common.is_user_has_access_to_its_group(server_ip).
Reduce the sudo scope granted to the Roxy-WI SSH credentials on managed servers to the minimum commands required by legitimate playbooks.

bash

# Example reverse proxy restriction for the install blueprint
location /install/ {
    allow 10.0.0.0/24;   # admin jump network
    deny all;
    auth_basic "Roxy-WI Admin";
    auth_basic_user_file /etc/nginx/.roxywi_admins;
    proxy_pass http://127.0.0.1:5000;
}