CVE-2026-45567: Roxy-WI Authentication Bypass Vulnerability

CVE-2026-45567 Overview

CVE-2026-45567 is an authentication bypass vulnerability [CWE-287] in Roxy-WI, a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. The flaw exists in versions 8.2.6.4 and prior. Attackers can bypass authentication by including the api substring in the request URL and reaching the unauthenticated /api/gpt endpoint. At time of publication, there are no publicly available patches. The vulnerability is network-exploitable, requires no privileges, and needs no user interaction.

Critical Impact
Remote unauthenticated attackers can bypass authentication on Roxy-WI management interfaces and access protected API functionality, exposing infrastructure managing Haproxy, Nginx, Apache, and Keepalived servers.

Affected Products

Roxy-WI versions 8.2.6.4 and prior
Deployments exposing the Roxy-WI web interface to untrusted networks
Environments using Roxy-WI to manage Haproxy, Nginx, Apache, or Keepalived

Discovery Timeline

2026-06-10 - CVE-2026-45567 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45567

Vulnerability Analysis

The vulnerability resides in how Roxy-WI evaluates incoming HTTP requests against its authentication layer. The application uses substring matching against the URL path to determine whether a request should be treated as an API call. When the URL contains the api substring, authentication checks are bypassed. This logic enables attackers to construct requests that the server treats as pre-authorized API traffic.

The /api/gpt endpoint is specifically reachable without authentication. An unauthenticated remote attacker can invoke this endpoint directly over the network. Because Roxy-WI manages load balancers and reverse proxies, abuse can extend beyond the management plane into the proxied services themselves.

The scope is changed under the scoring vector, indicating that a successful attack affects resources beyond the vulnerable component. Confidentiality, integrity, and availability impacts are each rated low individually, but the combined effect on infrastructure management software is significant.

Root Cause

The root cause is improper authentication [CWE-287]. The request router classifies a request as API traffic by matching the api substring anywhere in the URL rather than validating the route against a strict allowlist tied to authenticated session checks. This design conflates routing decisions with authorization decisions.

Attack Vector

An attacker sends an HTTP request to the Roxy-WI host with api present in the URL path. The authentication middleware permits the request to proceed to the application logic. The attacker then reaches /api/gpt or other API handlers without supplying valid credentials or session tokens. See the GitHub Security Advisory for additional technical context.

// No verified proof-of-concept code is published.
// Refer to the GHSA-4fcm-qgg8-w2vf advisory for technical details.

Detection Methods for CVE-2026-45567

Indicators of Compromise

Unauthenticated HTTP requests to paths containing the api substring, especially /api/gpt, in Roxy-WI access logs
Requests to Roxy-WI API endpoints lacking valid session cookies or authorization headers
Unexpected configuration changes to Haproxy, Nginx, Apache, or Keepalived services managed by Roxy-WI

Detection Strategies

Parse Roxy-WI web server logs for HTTP 200 responses on /api/* paths originating from unauthenticated sessions
Alert on POST or GET requests to /api/gpt from external or untrusted source IP addresses
Correlate Roxy-WI API access events with subsequent changes to managed proxy configurations

Monitoring Recommendations

Forward Roxy-WI access and application logs to a centralized SIEM for retention and analysis
Baseline normal administrative API usage patterns and flag deviations in request volume or source IP
Monitor outbound network connections from the Roxy-WI host for anomalous behavior following API access

How to Mitigate CVE-2026-45567

Immediate Actions Required

Restrict network access to Roxy-WI management interfaces using firewall rules or VPN-only access
Place Roxy-WI behind an authenticating reverse proxy that enforces credentials before requests reach the application
Audit access logs for prior unauthenticated requests to URLs containing the api substring
Rotate credentials and API tokens associated with Roxy-WI and the services it manages

Patch Information

At the time of publication, no official patch is available from the Roxy-WI maintainers. Track the GitHub Security Advisory GHSA-4fcm-qgg8-w2vf for updates and apply patches as soon as they are released.

Workarounds

Block external access to any URL path containing api at the network edge until a patch is available
Enforce mutual TLS or IP allowlisting at an upstream reverse proxy in front of Roxy-WI
Disable or firewall the /api/gpt endpoint specifically if it is not required for operations

bash

# Example nginx reverse proxy rule to block unauthenticated API access
location ~* /api/ {
    allow 10.0.0.0/8;
    deny all;
    auth_basic "Roxy-WI Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://roxy-wi-backend;
}