CVE-2026-45561: Roxy-WI SSRF Vulnerability

CVE-2026-45561 Overview

CVE-2026-45561 is a Server-Side Request Forgery (SSRF) vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw affects versions 8.2.6.4 and prior. The /smon/agent/{version,uptime,status,checks}/<server_ip> routes pass the URL path component verbatim into a requests.get() call without restricting the destination. Authenticated attackers can substitute arbitrary IP addresses, including cloud metadata endpoints and internal network ranges. No patches are publicly available at the time of publication.

Critical Impact
Authenticated attackers can force the Roxy-WI server to issue HTTP requests to internal services, cloud metadata endpoints such as 169.254.169.254, and loopback addresses, exposing credentials and sensitive configuration data.

Affected Products

Roxy-WI versions 8.2.6.4 and prior
Deployments exposing /smon/agent/* routes
Cloud-hosted Roxy-WI instances with access to instance metadata services

Discovery Timeline

2026-06-10 - CVE-2026-45561 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45561

Vulnerability Analysis

The vulnerability resides in Roxy-WI's agent communication routes. The application constructs outbound HTTP requests using an f-string of the form requests.get(f'http://{server_ip}:{agent_port}/...'), where server_ip is taken directly from the URL path. Flask's default URL converter accepts any string value, so the parameter is not validated as a registered agent address. An authenticated user can request /smon/agent/status/169.254.169.254, and the server will issue an HTTP GET to the AWS Instance Metadata Service. The response body returns to the attacker, enabling exfiltration of cloud credentials, IAM role tokens, and internal service responses. This issue is classified as [CWE-918] Server-Side Request Forgery.

Root Cause

The root cause is missing input validation on the server_ip path parameter. Roxy-WI does not constrain the value to an allowlist of registered agents, nor does it reject RFC1918 addresses, loopback ranges, or link-local metadata IPs. The default Flask string converter permits any non-slash characters, providing no security boundary.

Attack Vector

Exploitation requires an authenticated session with privileges to access the SMON agent routes. The attacker issues a request such as GET /smon/agent/checks/127.0.0.1 or GET /smon/agent/status/10.0.0.5 against the Roxy-WI interface. The server then connects to the attacker-specified host on the configured agent_port and returns the response body to the caller. This allows internal port scanning, access to cloud metadata services, and interaction with services that trust the Roxy-WI host's network position.

Detection Methods for CVE-2026-45561

Indicators of Compromise

Outbound HTTP requests from the Roxy-WI host to 169.254.169.254, 127.0.0.1, or unexpected RFC1918 addresses
Web access logs containing /smon/agent/ paths with IP values that do not match registered agents
Unusual DNS lookups or TCP connections originating from the Roxy-WI process to internal infrastructure

Detection Strategies

Inspect Roxy-WI HTTP access logs for /smon/agent/(version|uptime|status|checks)/ requests and correlate the trailing IP against the inventory of legitimate agent hosts
Monitor egress network flows from the Roxy-WI server for connections to cloud metadata endpoints or loopback interfaces
Alert on responses containing IAM credential patterns (AccessKeyId, SecretAccessKey, Token) returned through the Roxy-WI web tier

Monitoring Recommendations

Enable verbose request logging on the Roxy-WI Flask application and forward to a centralized log platform
Deploy egress filtering on the host and alert on any outbound traffic to 169.254.0.0/16 or non-agent destinations
Track authentication events for SMON-privileged users and correlate with agent route activity

How to Mitigate CVE-2026-45561

Immediate Actions Required

Restrict network access to the Roxy-WI management interface to trusted administrators only
Block outbound access from the Roxy-WI host to 169.254.169.254 and other metadata endpoints using host firewall rules
Audit user accounts with SMON privileges and revoke unnecessary access
Use IMDSv2 on AWS instances to require session tokens for metadata access

Patch Information

At time of publication, no official patch is available. Refer to the GitHub Security Advisory for updates from the maintainers.

Workarounds

Place the Roxy-WI host behind an egress proxy that allowlists only known agent IP addresses and ports
Apply iptables or nftables rules that deny outbound traffic from the Roxy-WI process to loopback, link-local, and unrelated RFC1918 ranges
Front the application with a reverse proxy or WAF rule that rejects /smon/agent/ requests whose path component is not in the registered agent list

bash

# Example nftables egress restriction for the Roxy-WI host
nft add table inet roxywi
nft add chain inet roxywi output { type filter hook output priority 0 \; }
nft add rule inet roxywi output ip daddr 169.254.169.254 drop
nft add rule inet roxywi output ip daddr 127.0.0.0/8 tcp dport != 5432 drop
nft add rule inet roxywi output ip daddr 10.0.0.0/8 ip daddr != { 10.0.1.10, 10.0.1.11 } drop