CVE-2026-45552: Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.beforerequest → @jwtrequired() (app/routes/install/routes.py:36-39). The individual endpoints installexporter, installwaf, installgeoip, checkgeoip, getexporterversion, and gettaskstatus are not wrapped in pageforadmin and do not call roxywicommon.isuserhasaccesstoitsgroup(serverip) or checkisserveringroup(serverip). Only the GET index page (installmonitoring) gates on roxywiauth.pageforadmin(level=2). Because the missing decorators omit both role and group checks, any logged-in user — including the default guest role 4 — can install/reconfigure exporters, WAF, and GeoIP databases on every server in the Roxy-WI database, regardless of tenant ownership. The Ansible playbooks run with the per-server SSH credential stored in Roxy-WI, which the credentials' rightful owner (a different tenant) has provisioned with sudo rights for the management workflow. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add the same role and group checks currently used by the install index page to each unprotected endpoint. Specifically, wrap install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status with roxywi_auth.page_for_admin (or equivalent) and call roxywi_common.is_user_has_access_to_its_group(server_ip) or check_is_server_in_group(server_ip) so that only authorized users in the server's tenant/group can trigger Ansible/SSH workflows. The file referenced is app/routes/install/routes.py (ensure bp.before_request → @jwt_required() is supplemented by the per-endpoint checks).
Roxy-WI (app/routes/install/routes.py - install blueprint) endpoint authorization / decorators = require admin role and group membership on install endpoints - Configuration
Temporarily remove or restrict privileges for the default guest role (role 4) so guest users cannot invoke installation or reconfiguration endpoints or execute Ansible jobs. Limit execute/install permissions to admin roles only until the per-endpoint authorization is implemented and verified.
Roxy-WI (roles/permissions) guest role (role 4) privileges = revoke install/execute privileges for guest role - Compensating control
While fixes are being implemented, restrict access to the Roxy-WI management interface and Ansible/SSH management plane via network controls: allow only trusted administrator IPs, apply firewall/ACL rules to limit who can reach Roxy-WI and the managed servers, or otherwise isolate the management network to prevent cross-tenant execution of playbooks.
- Operational
Rotate all per-server SSH credentials and any Ansible credentials stored in Roxy-WI that could have been used by unauthorized tenants. Re-provision new credentials only to appropriate tenant owners and invalidate previously stored keys/credentials before enabling installation functionality for non-admin users.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45552?
CVE-2026-45552 has a critical severity score of 9.9.
How do I fix CVE-2026-45552?
To fix CVE-2026-45552, upgrade Roxy-WI to version 8.2.6.5 or later.
What does CVE-2026-45552 affect?
CVE-2026-45552 affects the Roxy-WI web interface for managing server software such as Haproxy, Nginx, Apache, and Keepalived.
What are the risks associated with CVE-2026-45552?
CVE-2026-45552 allows a guest user to bypass authorization and execute Ansible/SSH commands on all registered servers.
When was CVE-2026-45552 published?
CVE-2026-45552 was published on June 10, 2026.