CVE-2026-45567: Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Roxy-WIfrom your environment.If the instance is not required, uninstall Roxy-WI or take the service offline until an official patch or fix is available.
- Configuration
If possible, disable the HTTP API endpoints or require authentication for any path containing 'api' (specifically /api/gpt). If Roxy-WI cannot natively disable these endpoints, configure the fronting web server or reverse proxy to block or require auth for requests to /api/* and /api/gpt.
Roxy-WI unauthenticated /api endpoints (including /api/gpt) = disabled or require authentication - Compensating control
Restrict access to the Roxy-WI management interface and API endpoints at network perimeter controls: allow only trusted management IPs via firewall/ACLs and/or deploy WAF rules to block requests that include the substring 'api' in the URL or specifically block /api/gpt requests.
- Operational
Monitor logs and indicators for any access to /api/gpt or other unauthenticated API access. Investigate suspicious activity and, if compromise is suspected, follow incident response procedures (including rotating affected credentials and sessions).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45567?
CVE-2026-45567 has a high severity rating of 8.3.
What does CVE-2026-45567 affect?
CVE-2026-45567 affects Roxy-WI versions 8.2.6.4 and prior.
How does CVE-2026-45567 exploit authentication?
CVE-2026-45567 allows for authentication bypass via the 'api' substring in the URL combined with an unauthenticated /api/gpt endpoint.
Are there any patches available for CVE-2026-45567?
At the time of publication, there are no publicly available patches for CVE-2026-45567.
What should be done to mitigate CVE-2026-45567?
To mitigate CVE-2026-45567, it is recommended to review access controls and restrict access to the affected endpoints.