CVE-2026-45558
Description
Roxy-WI versions prior to 8.2.6.4 allow authenticated users to inject HAProxy directives, leading to RCE on managed load balancers.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Roxy-WI versions prior to 8.2.6.4 allow authenticated users to inject HAProxy directives, leading to RCE on managed load balancers.
Vulnerability
Roxy-WI versions 8.2.6.4 and prior are vulnerable to configuration injection in their HAProxy section-save endpoints. The option field in requests to POST /api/service/haproxy/<server_id>/section/<section_type> and PUT /global/defaults is not validated or escaped. This allows an attacker to inject arbitrary HAProxy directives directly into the configuration files [1].
Exploitation
An authenticated user with a role of 3 or lower can exploit this vulnerability. They need to send a crafted JSON payload to the affected API endpoints, including an unescaped option field. This field can contain directives such as option external-check followed by a command to execute, like /bin/bash -c '...'. Roxy-WI then processes this input, generates the HAProxy configuration, and reloads the service, executing the injected command [1].
Impact
Successful exploitation allows an attacker to execute arbitrary commands on the load balancer as the haproxy user. This is achieved by injecting malicious HAProxy directives that are executed during the health-check process. The impact is remote code execution (RCE) on every load balancer managed by the affected Roxy-WI group [1].
Mitigation
At the time of publication, there are no publicly available patches for this vulnerability. Users are advised to monitor the vendor's security advisories for updates [1].
AI Insight generated on Jun 10, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The HAProxy configuration generation process does not validate or escape the 'option' field, allowing arbitrary directives to be injected."
Attack vector
An authenticated user with a role of 3 or lower can send a POST request to the HAProxy section-save endpoints or a PUT request to the global/defaults variants. This request includes a JSON payload with an unescaped 'option' field. The application then renders this field verbatim into the HAProxy configuration, which is subsequently pushed to the load balancer and reloaded. This allows an attacker to inject malicious HAProxy directives, such as `option external-check` followed by `external-check command /bin/bash -c '...'`, enabling remote code execution on the load balancer as the haproxy user [ref_id=1].
Affected code
The vulnerability lies within the HAProxy section-save endpoints, specifically the POST /api/service/haproxy/<server_id>/section/<section_type> and PUT /global/defaults variants. The 'option' field in the HaproxyConfigRequest, HaproxyGlobalRequest, and HaproxyDefaultsRequest models is not validated or escaped. This unvalidated input is then rendered into the HAProxy configuration via the section.j2, global.j2, and defaults.j2 Ansible templates [ref_id=1].
What the fix does
The advisory does not specify any patches. However, it recommends several remediation steps. These include rejecting newlines and HAProxy-meaningful characters in free-text fields, enforcing an allow-list of permitted directive prefixes for the 'option' field, or rendering directives from a structured model instead of free text. Additionally, it suggests defense in depth on the load balancer side by performing configuration syntax checks before reloading [ref_id=1].
Preconditions
- authThe attacker must be authenticated with a user role of 3 or lower.
- configThe Roxy-WI instance must be managing at least one HAProxy load balancer.
Reproduction
The reference write-up provides a detailed proof of concept, including Jinja2 rendering of the template with malicious input and an end-to-end HTTP PoC using curl to demonstrate the RCE by injecting a command that calls back to an attacker-controlled server [ref_id=1].
Generated on Jun 10, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.