Is CVE-2026-45561 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45561 being exploited in the wild.

How severe is CVE-2026-45561?

Medium severity, with a CVSS score of 6.5, published 10 June 2026.

Is there a fix for CVE-2026-45561?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45561 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45561?

Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45561: Roxy-WI SSRF in SMON agent routes

CVE-2026-45561 · Severity: medium · CVSS 6.5 · Published 2026-06-10

Roxy-WI, a management interface for web servers like HAProxy and Nginx, contains a security flaw that allows authenticated users to perform unauthorized network requests. An attacker could use this to access sensitive internal services or steal cloud credentials (such as AWS IAM roles) that are normally protected from the outside world. This could lead to a significant data breach or further compromise of the organization's cloud infrastructure.

Technologies: Roxy-WI. Vendors: Roxy-WI.

Quick answers

Is CVE-2026-45561 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45561 being exploited in the wild.
How severe is CVE-2026-45561?: Medium severity, with a CVSS score of 6.5, published 10 June 2026.
Which products and versions are affected?: Roxy-WI <= 8.2.6.4.
Is there a fix for CVE-2026-45561?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45561 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45561?: Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Roxy-WI versions 8.2.6.4 and prior within the /smon/agent/{version,uptime,status,checks}/<server_ip> routes. The application takes the 'server_ip' path component and passes it directly into a Python 'requests.get' call without validation against an allow-list or IP range filter. An authenticated attacker can provide loopback addresses (127.0.0.1), private RFC1918 addresses, or cloud metadata IP addresses (169.254.169.254) to exfiltrate sensitive information or interact with internal-only services. As of the advisory date, no official patches are available, and users are advised to implement manual IP validation checks.

Affected products

Roxy-WI Roxy-WI <= 8.2.6.4

Timeline

2026-05-15: advisory: GitHub Security Advisory published
2026-06-10: disclosed: CVE published to NVD

References

https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-2crj-7rqc-x7rq

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.