Is CVE-2026-45567 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45567 being exploited in the wild.

How severe is CVE-2026-45567?

High severity, with a CVSS score of 8.3, published 10 June 2026.

Is there a fix for CVE-2026-45567?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45567 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45567?

Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45567: Roxy-WI authentication bypass via URL substring manipulation

CVE-2026-45567 · Severity: high · CVSS 8.3 · Published 2026-06-10

Roxy-WI, a management interface for web servers like Nginx and HAProxy, contains a security flaw that allows unauthorized users to bypass login requirements. By simply adding a specific keyword to a web address, an attacker can access internal functions without a password. This could lead to the theft of license keys, unauthorized use of paid AI services (GPT) at the owner's expense, and potential access to sensitive server management features.

Technologies: Roxy-WI. Vendors: Roxy-WI.

Quick answers

Is CVE-2026-45567 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45567 being exploited in the wild.
How severe is CVE-2026-45567?: High severity, with a CVSS score of 8.3, published 10 June 2026.
Which products and versions are affected?: Roxy-WI <= 8.2.6.4.
Is there a fix for CVE-2026-45567?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45567 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45567?: Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass exists in Roxy-WI's global 'before_request' hook in 'app/login.py'. The application incorrectly skips authentication if the substring 'api' is present anywhere in the request URL, including query parameters (e.g., '/overview/?api=1'). Additionally, the '/api/gpt' endpoint was registered directly on the main application object rather than the API blueprint, causing it to lack both the global authentication check and the blueprint's specific security decorators. Attackers can exploit this to reach sensitive handlers without credentials, potentially leaking license keys or exhausting GPT quotas. As of the advisory date, no patches are available.

Affected products

Roxy-WI Roxy-WI <= 8.2.6.4

Timeline

2026-05-15: advisory: GitHub Security Advisory published
2026-06-10: disclosed: CVE-2026-45567 published to NVD

References

https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-4fcm-qgg8-w2vf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.