CVE-2026-45556: Roxy-WI: Authenticated arbitrary file write on every managed load balancer (and downstream RCE) via WAF rule save `config_file_name`
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf/<service>/<serverip>/rule/<ruleid>/save accepts a configfilename form field that is passed straight through to configmod.masterslaveuploadandrestart(...) as the destination path. The validation chain (replaceconfigpathtocorrect → checkisconf) only requires the path to contain a hard-coded service substring (nginx/haproxy/apache2/httpd/keepalived) and the substring conf or cfg, and to not contain ... The encoded-slash substitution 92 → / is applied before the substring check, so the attacker can build any absolute path anywhere on the LB filesystem as long as it satisfies those substring constraints. The body of the WAF rule (config form field) is written verbatim to that path. By choosing a filename like 92etc92cron.d92nginxcfgevil (resolving to /etc/cron.d/nginxcfgevil), an attacker drops a cron entry on the load balancer with attacker-controlled content. Cron parses the file on its next scan, executing the embedded job as root — full RCE on every load balancer the caller's group manages. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Roxy-WIfrom your environment.If Roxy-WI is not required in your environment, consider uninstalling or disabling Roxy-WI instances until an official fix is released.
- Configuration
Disable the WAF rule save/upload functionality (the POST /waf/<service>/<server_ip>/rule/<rule_id>/save endpoint) in Roxy-WI configuration until a vendor-provided patch is available.
Roxy-WI waf_rule_save = disabled - Compensating control
Restrict network access to the Roxy-WI web interface and API to trusted administrator IPs or via an administrative VPN. Block access from the public Internet with firewall/ACLs to reduce the attacker surface for authenticated abuse.
- Compensating control
At the perimeter WAF or reverse proxy, block or filter POST requests to the WAF rule save endpoint (POST /waf/*/rule/*/save) to prevent uploading arbitrary rule bodies until an official fix is available.
- Operational
On every managed load balancer, inspect for and remove unexpected files or cron entries created by this issue — in particular check /etc/cron.d and other configuration directories for files whose names or contents resemble uploaded WAF rule bodies (e.g., filenames resolving from encoded slashes such as 92etc92cron.d92*). Remove malicious files, clean up cron entries, and restart cron services as needed.
- Operational
If any administrative accounts or API keys that can manage WAF rules may have been abused, rotate those credentials and API keys, review Roxy-WI and load balancer audit logs for suspicious activity, and disable compromised accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45556?
CVE-2026-45556 has a critical severity rating of 9.9.
How do I fix CVE-2026-45556?
To resolve CVE-2026-45556, update to the latest version of Roxy-WI beyond version 8.2.6.4.
What systems are affected by CVE-2026-45556?
CVE-2026-45556 affects Roxy-WI versions 8.2.6.4 and prior.
What type of vulnerability is CVE-2026-45556?
CVE-2026-45556 is classified as an authenticated arbitrary file write vulnerability leading to potential remote code execution.
What can be compromised due to CVE-2026-45556?
CVE-2026-45556 can lead to a complete compromise of managed load balancers and potentially downstream systems.