CVE-2026-45561: Roxy-WI: SSRF in /smon/agent/<endpoint>/<server_ip> reachable to cloud metadata IPs
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the /smon/agent/{version,uptime,status,checks}/<serverip> family of routes takes the URL path component verbatim into requests.get(f'http://{serverip}:{agentport}/...'). The path component is constrained only by Flask's default URL converter, which permits any value (including IPv4 literals like 169.254.169.254, RFC1918 ranges, and 127.0.0.1). At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Validate the <server_ip> path component on the server side and allow only a known/expected set of management IPs. Explicitly reject addresses such as 169.254.169.254, 127.0.0.1 and RFC1918 ranges before using the value in requests.get().
Roxy-WI /smon agent routes server_ip input validation/whitelist = whitelist only expected management IPs; reject metadata and internal IPs - Configuration
Disable the /smon/agent/{version,uptime,status,checks}/<server_ip> routes if they are not required, or restrict access to them to trusted admin users/networks only.
Roxy-WI /smon agent routes expose_smon_routes = disabled or access-restricted - Configuration
Replace or augment Flask's default URL converter for the <server_ip> path component with a strict IP-address converter or explicit validation logic to prevent arbitrary hostnames/IPs from being passed verbatim to requests.get().
Flask routing for /smon/agent URL converter/input parsing = use stricter IP/address converter or explicit validation - Compensating control
Block outbound HTTP(S) access from the Roxy-WI host to cloud metadata and internal address ranges (for example 169.254.169.254, 127.0.0.1 and RFC1918 ranges) using host-based firewall rules, network ACLs, or proxy egress controls.
- Compensating control
Restrict access to the Roxy-WI web interface and management endpoints to trusted networks/IPs (for example via network firewall rules, VPN access, or an application gateway) to reduce exposure of the vulnerable routes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45561?
The severity of CVE-2026-45561 is medium with a score of 6.5.
What type of vulnerability is identified in CVE-2026-45561?
CVE-2026-45561 is an SSRF (Server-Side Request Forgery) vulnerability.
How do I fix CVE-2026-45561?
To fix CVE-2026-45561, upgrade to Roxy-WI version 8.2.6.5 or later where the vulnerability has been addressed.
What components are affected by CVE-2026-45561?
CVE-2026-45561 affects the /smon/agent routes in Roxy-WI versions 8.2.6.4 and prior.
What is the potential impact of CVE-2026-45561?
The potential impact of CVE-2026-45561 includes unauthorized access to cloud metadata IPs through SSRF.