Executive brief
Roxy-WI is a management interface used to configure and control load balancers like HAProxy and Nginx. A security flaw allows an authorized user to inject malicious commands into the load balancer's configuration files. If exploited, an attacker can take full control of the load balancer servers, potentially leading to the theft of encryption keys, access to internal networks, or a complete shutdown of web traffic.
Technical details
A command injection vulnerability exists in Roxy-WI versions 8.2.6.4 and prior due to improper validation of the 'option' field in HAProxy configuration endpoints (POST /api/service/haproxy/<server_id>/section/<section_type> and related PUT variants). The application fails to escape newline characters in JSON input, which are then rendered verbatim into Ansible templates (section.j2, global.j2, defaults.j2). An authenticated attacker with 'user' level privileges (role <= 3) can inject arbitrary HAProxy directives, such as 'external-check command', to achieve remote code execution (RCE) as the haproxy user on all managed load balancers. At the time of the advisory, no patches are available.
Affected products
- Roxy-WI Roxy-WI <= 8.2.6.4
Timeline
- 2026-05-15: advisory: Initial GitHub security advisory published
- 2026-06-10: disclosed: CVE-2026-45558 published to NVD