CVE-2026-45564: Roxy-WI Command Injection Vulnerability

CVE-2026-45564 Overview

CVE-2026-45564 is an authenticated command injection vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw affects versions 8.2.6.4 and prior. The POST /config/versions/<service>/<server_ip>/<configver>/save endpoint interpolates the configver URL parameter directly into a shell command executed by os.system. An authenticated user with role level 3 (user) or lower can reach a /bin/sh -c command-injection sink. No patch is available at the time of publication.

Critical Impact
Any authenticated low-privilege Roxy-WI user can execute arbitrary operating system commands on the host managing HAProxy, Nginx, Apache, and Keepalived infrastructure.

Affected Products

Roxy-WI versions 8.2.6.4 and prior
Deployments exposing the /config/versions/<service>/<server_ip>/<configver>/save endpoint
HAProxy, Nginx, Apache, and Keepalived environments managed through Roxy-WI

Discovery Timeline

2026-06-10 - CVE-2026-45564 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45564

Vulnerability Analysis

The vulnerability is an OS command injection flaw classified under [CWE-78]. Roxy-WI exposes a configuration version save endpoint that accepts a path-segment parameter named configver. The application passes this parameter into a Python f-string that constructs a shell command: os.system(f"dos2unix -q {cfg}"). Because Python's os.system invokes /bin/sh -c, shell metacharacters in configver allow command injection.

Exploitation requires authentication, but the minimum required role is <= 3 (user), which is the lowest tier in the Roxy-WI role hierarchy. The vulnerability grants attackers the same execution context as the Roxy-WI service account.

Root Cause

The configver parameter is declared as a str path segment in the Pydantic model. Pydantic does not validate path segments declared as str, so the value bypasses the EscapedString sanitizer applied to other inputs. The surrounding .. block intended to restrict allowed values is a broken tuple-membership check inherited from the incomplete patch for GHSA-vapt-004. The combination of missing escaping and a broken allowlist allows arbitrary shell metacharacters to flow into the command string.

Attack Vector

An authenticated attacker holding a user role sends a crafted HTTP POST request to /config/versions/<service>/<server_ip>/<configver>/save. The attacker embeds shell metacharacters such as backticks, $(), or ; inside the configver path segment. When the backend constructs the dos2unix command and passes it to os.system, the shell interprets the injected payload. The injected commands execute under the Roxy-WI service account, providing a foothold for lateral movement to the managed HAProxy, Nginx, Apache, and Keepalived nodes. See the GitHub Security Advisory for full technical details.

Detection Methods for CVE-2026-45564

Indicators of Compromise

Requests to /config/versions/*/save containing shell metacharacters such as ;, |, &, backticks, or $() in the configver path segment
Unexpected child processes spawned by the Roxy-WI Python process, particularly shells like /bin/sh, bash, nc, curl, or wget
Outbound connections from the Roxy-WI host to attacker-controlled infrastructure following a versions save request
New cron jobs, SSH keys, or files written under the Roxy-WI service account home directory

Detection Strategies

Inspect web server and reverse proxy access logs for URL-encoded shell characters in the configver path component
Monitor process telemetry for dos2unix invocations followed by anomalous child processes
Correlate authenticated session activity from user role accounts with subsequent shell command execution on the host

Monitoring Recommendations

Enable verbose application logging on the /config/versions/ route to capture the raw configver value
Alert on any non-alphanumeric characters appearing in the configver parameter
Track parent-child process lineage for the Roxy-WI worker process and flag deviations from baseline

How to Mitigate CVE-2026-45564

Immediate Actions Required

Restrict network access to the Roxy-WI management interface to trusted administrative networks only
Audit and reduce the number of accounts with user role or higher, removing any unused or shared credentials
Rotate credentials for all Roxy-WI accounts and enforce strong authentication
Monitor the Roxy-WI host for unexpected process execution and outbound network connections

Patch Information

No official patch is available at the time of publication. Refer to the GitHub Security Advisory GHSA-w42x-3v8j-cmg2 for vendor updates and apply fixes as soon as they are released.

Workarounds

Place the Roxy-WI interface behind a VPN or zero-trust gateway to block unauthenticated network exposure
Deploy a reverse proxy rule that rejects requests to /config/versions/ whose path segments contain characters outside [A-Za-z0-9._-]
Temporarily disable the configuration versioning feature if it is not in active operational use
Run the Roxy-WI service under a least-privilege account with no sudo rights to limit blast radius

bash

# Example NGINX reverse proxy rule rejecting shell metacharacters in configver
location ~ ^/config/versions/[^/]+/[^/]+/([^/]+)/save$ {
    if ($1 ~ "[^A-Za-z0-9._-]") {
        return 400;
    }
    proxy_pass http://roxywi_backend;
}