CVE-2026-45558
- Source
- https://cve.org/CVERecord?id=CVE-2026-45558
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45558.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-45558
- Aliases
-
- GHSA-w2x4-66jj-3597
- Published
- 2026-06-10T14:01:42.317Z
- Modified
- 2026-07-15T01:49:18.392488961Z
- Severity
-
- 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save
- Details
-
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy/<server_id>/section/<section_type> and the PUT / global / defaults variants) accept a JSON option field that is not validated, not escaped, and is rendered verbatim into the generated HAProxy configuration via the section.j2, global.j2, and defaults.j2 Ansible templates. Because Roxy-WI then pushes the generated config to the load balancer and runs systemctl reload haproxy, an authenticated user with role ≤ 3 (user) can inject arbitrary HAProxy directives into the config that runs on every load balancer their group manages — including option external-check + external-check command /bin/bash -c '…', which gives remote code execution on the load balancer as the haproxy user on every health-check tick. At time of publication, there are no publicly available patches.
- Database specific
{ "cwe_ids": [ "CWE-20", "CWE-77", "CWE-78", "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45558.json", "cna_assigner": "GitHub_M" }- References