CVE-2026-45549: Roxy-WI Privilege Escalation Allows Any Authenticated User to Disrupt Infrastructure Services

Technical summary

The agent_action endpoint in app/routes/smon/agent_routes.py (lines 166–179) is protected only by JWT authentication via the @jwt_required() decorator. It lacks both role-based access control (RBAC) and server group ownership validation. The vulnerable endpoint accepts a server_ip form parameter and executes systemd service control commands (start, stop, restart) on the roxy-wi-smon-agent unit. Because Roxy-WI invokes these commands over SSH with passwordless sudo configured for its service account, the systemd actions run with root privileges on the target server. An authenticated user with any role, including guest (role 4), can invoke this action against any reachable server in the managed infrastructure by simply naming its IP address.

Business impact

Organizations relying on Roxy-WI to manage production load balancers and web servers face two immediate risks: (1) availability disruption—an insider or compromised low-privilege account can remotely disable monitoring and management agents on critical infrastructure, creating a denial-of-service condition; (2) loss of observability—stopping the monitoring agent blinds your infrastructure telemetry at a critical moment, potentially masking secondary attacks. In environments where Roxy-WI manages Keepalived HA clusters or load balancing, stopping the agent can cause failover events or service interruptions. Compliance frameworks (SOC 2, ISO 27001, PCI-DSS) typically expect role-based access controls on privileged operations; this finding may indicate control gaps requiring remediation.

Affected systems

All Roxy-WI installations running version 8.2.6.4 or earlier are affected. Any Roxy-WI user account—regardless of assigned role—can exploit this vulnerability if they have network access to the Roxy-WI web interface. The vulnerability does not require special permissions, admin privileges, or valid credentials on the managed infrastructure itself; authentication to Roxy-WI is the only requirement. All managed servers registered in Roxy-WI (HAProxy, Nginx, Apache, Keepalived) and their agents are at risk if the underlying SSH passwordless sudo configuration is in place.

Exploitability

Exploitability is straightforward and requires minimal technical sophistication. An attacker with valid Roxy-WI credentials—including a low-privilege guest account—can issue HTTP POST requests to the /agent/action/<action> endpoint, specifying any managed server IP and systemd action (start, stop, restart). No privilege escalation, chaining, or special conditions are needed; the vulnerability is directly exploitable with a single authenticated request. The attack is difficult to attribute if audit logging at the Roxy-WI level is incomplete, and it leaves minimal forensic evidence on the managed servers themselves if logging is not centralized. Automated scanning and password spraying against Roxy-WI instances could discover and exploit this at scale.

Remediation

Until a vendor patch is available, implement the following controls: (1) restrict network access to the Roxy-WI web interface using network segmentation, IP whitelisting, or VPN-only access; (2) audit all Roxy-WI user accounts and remove or disable unnecessary guest and low-privilege accounts; (3) implement application-level or API gateway-level access controls to restrict who can invoke /agent/action endpoints, by role or group; (4) review and tighten SSH passwordless sudo configuration on managed servers to require approval or multi-factor verification for agent restarts; (5) enable centralized audit logging and alerting on systemd service control events. Monitor vendor advisories closely for a patched version, and plan to upgrade immediately once available.

Patch guidance

As of the publication date (June 2026), no official vendor patch is available. Monitor the Roxy-WI project repository and vendor security advisories regularly. When a patched version is released, verify the release notes confirm that the agent_action endpoint now enforces role-based access control and server group ownership validation before applying any systemd commands. Test the patch in a non-production environment first, paying particular attention to whether guest users and lower-privilege roles retain access only to servers they should manage. The fix should include code review of all @jwt_required() decorators throughout the application to identify similar missing authorization checks.

Detection guidance

Search application logs and Roxy-WI audit trails for POST requests to /agent/action/* from low-privilege accounts (role 4, guests). Look for repeated calls targeting multiple distinct server IPs, which may indicate reconnaissance or mass exploitation. Monitor SSH session logs on managed servers for roxy-wi user invocations of systemctl or systemd-run commands, particularly for the roxy-wi-smon-agent unit. Check for unexpected systemd service state changes (stop, restart) during maintenance windows or on servers not undergoing planned changes. Enable comprehensive audit logging for all authenticated actions in Roxy-WI; if not already in place, this should be an immediate priority.

Why prioritize this

This vulnerability scores 8.5 CVSS (HIGH) and poses a material risk to infrastructure availability and observability. It requires only low-privilege authentication, affects all versions in the 8.2.6.4 lineage and earlier, and allows unauthenticated impact on core services. While the CVSS does not reach CRITICAL because it does not enable remote code execution or confidentiality loss, the ability for any authenticated user to disrupt load balancing and monitoring makes it a priority for immediate access control mitigation and vendor communication.

Risk score, explained

The CVSS 3.1 score of 8.5 reflects: (1) network-based attack vector with no special physical or user interaction required; (2) low attack complexity—the endpoint is directly callable; (3) low privilege requirement—guest users (role 4) can exploit it; (4) scope change—impact extends beyond the Roxy-WI application to managed infrastructure services; (5) high availability impact (A:H)—stopping the monitoring agent or service units causes denial of service; (6) low integrity impact (I:L)—no direct data modification, but service control is a form of indirect integrity loss; (7) no confidentiality impact. The score does not reach CRITICAL because it does not enable code execution or information disclosure; however, the scope change and high availability impact elevate it above typical MEDIUM-severity authorization issues.

Frequently asked questions