CVE-2026-45558: Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy/<serverid>/section/<sectiontype> and the PUT / global / defaults variants) accept a JSON option field that is not validated, not escaped, and is rendered verbatim into the generated HAProxy configuration via the section.j2, global.j2, and defaults.j2 Ansible templates. Because Roxy-WI then pushes the generated config to the load balancer and runs systemctl reload haproxy, an authenticated user with role ≤ 3 (user) can inject arbitrary HAProxy directives into the config that runs on every load balancer their group manages — including option external-check + external-check command /bin/bash -c '…', which gives remote code execution on the load balancer as the haproxy user on every health-check tick. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Roxy-WIfrom your environment.Uninstall Roxy-WI if it is not required in order to eliminate the attack surface provided by the vulnerable management interface.
- Configuration
Restrict the HAProxy section-save endpoints (POST /api/service/haproxy/<server_id>/section/<section_type> and the PUT /.../global/defaults variants) so that only administrative roles may save sections. Ensure users with role ≤3 cannot call these endpoints to prevent untrusted config injection.
Roxy-WI HAProxy section save permission = admin only (disallow role ≤3 users) - Configuration
Disable 'option external-check' and any 'external-check command' usage in HAProxy configuration where not strictly required to prevent execution of arbitrary commands injected into the generated config.
HAProxy option external-check / external-check command = disabled - Compensating control
Restrict network access to the Roxy-WI management interface and API to trusted administrative IPs/VPNs using firewall rules, ACLs or a management network to limit who can authenticate and reach the API.
- Compensating control
Prevent Roxy-WI from automatically pushing generated configs and running 'systemctl reload haproxy' on managed load balancers. Remove or restrict service-control privileges (e.g., via sudoers, service account permissions, or isolation) so configuration changes require manual review and deployment.
- Operational
Audit current/generated HAProxy configurations produced by Roxy-WI for unexpected or malicious directives (for example 'option external-check' and 'external-check command ...'). Remove any injected directives, roll back to a known-good config, and reload HAProxy from a verified configuration.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45558?
CVE-2026-45558 has a critical severity rating of 9.9.
How does CVE-2026-45558 affect Roxy-WI?
CVE-2026-45558 allows for authenticated remote code execution on managed HAProxy load balancers through option field config injection.
What versions of Roxy-WI are affected by CVE-2026-45558?
Versions of Roxy-WI up to and including 8.2.6.4 are affected by CVE-2026-45558.
How can I mitigate CVE-2026-45558?
To mitigate CVE-2026-45558, upgrade to a patched version of Roxy-WI that addresses the input validation issues.
Is CVE-2026-45558 exploitable without authentication?
No, CVE-2026-45558 requires authentication to exploit due to its nature of affecting the authenticated capabilities of Roxy-WI.