CVE-2026-45567: Roxy-WI Authentication Bypass in HAProxy/Nginx Management Interface

Technical summary

CVE-2026-45567 exploits improper access control in Roxy-WI's authentication middleware. The vulnerability stems from a URL parsing logic flaw where the presence of 'api' in the request path triggers a bypass of credential validation for the /api/gpt endpoint. The issue affects versions 8.2.6.4 and below. The attack surface is network-accessible, requires no user interaction, and carries no privilege prerequisites—an unauthenticated remote attacker can directly invoke the vulnerable endpoint.

Business impact

Organizations using Roxy-WI to manage their load-balancing and web server infrastructure face direct compromise of administrative access. An attacker gaining unauthorized access to the management interface can reconfigure HAProxy, Nginx, Apache, or Keepalived settings, redirect traffic, inject malicious content, disrupt availability, or gather sensitive infrastructure data. The scope extends across the entire managed infrastructure, potentially affecting all downstream services dependent on these servers.

Affected systems

Roxy-WI version 8.2.6.4 and all prior releases are vulnerable. The web interface itself runs on the administrator's network, typically accessible from trusted networks or VPNs, but the authentication bypass means that network boundary alone does not provide protection. Any system with Roxy-WI deployed to manage HAProxy, Nginx, Apache, or Keepalived instances is at risk.

Exploitability

Exploitability is straightforward. The vulnerability requires only network access to the Roxy-WI web interface port and knowledge of the /api/gpt endpoint. No authentication credentials, user interaction, or complex exploitation technique is needed. An attacker can issue a simple HTTP request to the affected endpoint and retrieve or manipulate configuration data. The low attack complexity and absence of barriers make this high-risk from an exploitation standpoint.

Remediation

At publication, no official security patches are available from the Roxy-WI developers. Organizations must implement interim controls: restrict network access to the Roxy-WI management interface using firewall rules or IP allowlisting, isolate it to a dedicated administrative network segment, disable or rename the /api/gpt endpoint if not in active use, and monitor for suspicious API calls. Upgrade to a patched version immediately when released by checking the vendor's security advisories.

Patch guidance

No patches were available at time of vulnerability publication (2026-06-10). Monitor Roxy-WI's official release notes and security advisories for a patched version. When a fix becomes available, verify the version number against the vendor advisory to confirm it addresses CVE-2026-45567. Plan a maintenance window to deploy the patch, as it will likely require a restart of the management interface. Test in a non-production environment first.

Detection guidance

Hunt for HTTP requests to /api/gpt or similar /api/* endpoints that originate from unexpected sources or lack proper authentication headers. Log and alert on any successful responses (HTTP 200) from the /api/gpt endpoint without preceding successful login or session establishment. Review Roxy-WI access logs for patterns of unauthenticated API calls. Consider deploying a Web Application Firewall (WAF) rule to block requests to /api/gpt unless they include valid session tokens or originate from whitelisted IPs.

Why prioritize this

This vulnerability warrants urgent prioritization. It enables complete bypass of authentication to a critical infrastructure management tool with a CVSS score of 8.3 (High). The attack requires no user interaction or special privileges, affects all deployed versions up to 8.2.6.4, and can be exploited remotely over the network with minimal effort. Exposure of the Roxy-WI interface directly jeopardizes the security posture of all managed load-balancers and web servers. The absence of publicly available patches at publication further elevates the risk, as only defensive measures are immediately available.

Risk score, explained

CVSS 3.1 score of 8.3 reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), no user interaction needed (UI:N), changed scope (S:C) affecting other systems beyond the vulnerable component, and confidentiality/integrity/availability impacts (C:L/I:L/A:L). The High severity rating is justified given the centrality of Roxy-WI in infrastructure management and the trivial exploitation path.

Frequently asked questions