# CVE-2026-45561: Roxy-WI SSRF in SMON agent routes

Source: https://junglewise.ai/threats/cve-2026-45561-roxy-wi-ssrf-in-smon-agent-routes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-45561 · Severity: medium · CVSS 6.5 · Published 2026-06-10

Roxy-WI, a management interface for web servers like HAProxy and Nginx, contains a security flaw that allows authenticated users to perform unauthorized network requests. An attacker could use this to access sensitive internal services or steal cloud credentials (such as AWS IAM roles) that are normally protected from the outside world. This could lead to a significant data breach or further compromise of the organization's cloud infrastructure.

Technologies: [Roxy-WI](https://junglewise.ai/threats/technologies/roxy-wi). Vendors: [Roxy-WI](https://junglewise.ai/threats/vendors/roxy-wi).

## Quick answers

**Is CVE-2026-45561 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45561 being exploited in the wild.

**How severe is CVE-2026-45561?** Medium severity, with a CVSS score of 6.5, published 10 June 2026.

**Which products and versions are affected?** Roxy-WI <= 8.2.6.4.

**Is there a fix for CVE-2026-45561?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45561 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45561?** Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Roxy-WI versions 8.2.6.4 and prior within the /smon/agent/{version,uptime,status,checks}/<server_ip> routes. The application takes the 'server_ip' path component and passes it directly into a Python 'requests.get' call without validation against an allow-list or IP range filter. An authenticated attacker can provide loopback addresses (127.0.0.1), private RFC1918 addresses, or cloud metadata IP addresses (169.254.169.254) to exfiltrate sensitive information or interact with internal-only services. As of the advisory date, no official patches are available, and users are advised to implement manual IP validation checks.

## Affected products

- Roxy-WI Roxy-WI <= 8.2.6.4

## Timeline

- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD

## References

- [https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-2crj-7rqc-x7rq](https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-2crj-7rqc-x7rq)

## Related threats

- [Roxy-WI path traversal in configuration management](https://junglewise.ai/threats/cve-2026-45569-roxy-wi-path-traversal-in-configuration-management)
- [Roxy-WI authentication bypass via URL substring manipulation](https://junglewise.ai/threats/cve-2026-45567-roxy-wi-authentication-bypass-via-url-substring-manipulation)
- [Roxy-WI open redirect in login flow via userinfo syntax bypass](https://junglewise.ai/threats/cve-2026-45566-roxy-wi-open-redirect-in-login-flow-via-userinfo-syntax-bypass)
- [Roxy-WI input validation bypass in EscapedString validator](https://junglewise.ai/threats/cve-2026-45565-roxy-wi-input-validation-bypass-in-escapedstring-validator)
- [Roxy-WI command injection in config versions save route](https://junglewise.ai/threats/cve-2026-45564-roxy-wi-command-injection-in-config-versions-save-route)