CVE-2026-45549: Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, agentaction (app/routes/smon/agentroutes.py:166-179) has decorators @bp.post('/agent/action/<action>') and @jwtrequired() only — no role check, no group ownership check on the serverip form field. Any authenticated user, including role 4 (guest), can start, stop, or restart the roxy-wi-smon-agent systemd unit on any server they can name. Roxy-WI executes the systemd action over its own SSH credentials (passwordless sudo), so the action runs as root on the target. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Roxy-WIfrom your environment.If Roxy-WI is not required, uninstall it or remove/disable the smon agent functionality until an official fix is available.
- Configuration
Modify the POST /smon/agent/action/<action> route handler to require an appropriate administrative role and to verify that the authenticated user or their group actually owns the server_ip before executing any systemd action.
Roxy-WI (app/routes/smon/agent_routes.py) authorization and ownership checks for /smon/agent/action/<action> = enforce role-based authorization and group/server ownership verification; deny guest (role 4) from invoking agent actions - Configuration
Remove passwordless sudo for the SSH account Roxy-WI uses, or restrict its sudoers entry to only the minimal, explicitly allowed commands (do not allow arbitrary systemctl/systemd control).
Roxy-WI SSH account / sudoers passwordless sudo / allowed sudo commands = disable passwordless sudo or restrict allowed commands - Configuration
Temporarily disable the POST /smon/agent/action/<action> endpoint or restrict it to administrative users only until a proper upstream patch is available.
Roxy-WI (web endpoint) POST /smon/agent/action/<action> accessibility = disabled or admin-only - Compensating control
Restrict network access to the Roxy-WI management interface and API (including /smon endpoints) to trusted IP ranges, place it behind a VPN/bastion, or enforce firewall rules to block untrusted networks.
- Operational
Audit logs on Roxy-WI and target servers for unauthorized systemctl/systemd actions, investigate any suspicious activity, and rotate or replace SSH keys and credentials used by Roxy-WI and affected hosts if compromise is suspected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45549?
The severity of CVE-2026-45549 is classified as high with a score of 8.5.
How do I fix CVE-2026-45549?
To fix CVE-2026-45549, update Roxy-WI to version 8.2.6.5 or later, which includes role and group ownership checks.
What systems are affected by CVE-2026-45549?
CVE-2026-45549 affects versions 8.2.6.4 and prior of Roxy-WI web interface.
What type of vulnerability is CVE-2026-45549?
CVE-2026-45549 is an authorization bypass vulnerability affecting the POST /smon/agent/action/<action> endpoint.
What are the potential impacts of CVE-2026-45549?
The potential impacts of CVE-2026-45549 include unauthorized users being able to stop or restart the smon-agent on any host.