Is CVE-2026-45558 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45558 being exploited in the wild.

How severe is CVE-2026-45558?

Critical severity, with a CVSS score of 9.9, published 10 June 2026.

Is there a fix for CVE-2026-45558?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45558 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45558?

Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45558: Roxy-WI command injection in HAProxy section-save endpoints

CVE-2026-45558 · Severity: critical · CVSS 9.9 · Published 2026-06-10

Roxy-WI is a management interface used to configure and control load balancers like HAProxy and Nginx. A security flaw allows an authorized user to inject malicious commands into the load balancer's configuration files. If exploited, an attacker can take full control of the load balancer servers, potentially leading to the theft of encryption keys, access to internal networks, or a complete shutdown of web traffic.

Technologies: Roxy-WI. Vendors: Roxy-WI.

Quick answers

Is CVE-2026-45558 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45558 being exploited in the wild.
How severe is CVE-2026-45558?: Critical severity, with a CVSS score of 9.9, published 10 June 2026.
Which products and versions are affected?: Roxy-WI <= 8.2.6.4.
Is there a fix for CVE-2026-45558?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45558 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45558?: Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in Roxy-WI versions 8.2.6.4 and prior due to improper validation of the 'option' field in HAProxy configuration endpoints (POST /api/service/haproxy/<server_id>/section/<section_type> and related PUT variants). The application fails to escape newline characters in JSON input, which are then rendered verbatim into Ansible templates (section.j2, global.j2, defaults.j2). An authenticated attacker with 'user' level privileges (role <= 3) can inject arbitrary HAProxy directives, such as 'external-check command', to achieve remote code execution (RCE) as the haproxy user on all managed load balancers. At the time of the advisory, no patches are available.

Affected products

Roxy-WI Roxy-WI <= 8.2.6.4

Timeline

2026-05-15: advisory: Initial GitHub security advisory published
2026-06-10: disclosed: CVE-2026-45558 published to NVD

References

https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-w2x4-66jj-3597

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.