CVE-2026-45567: fallo de gravedad alta en roxy-wi
Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.3epss 0.2%
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no publicly available patches.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Productos afectados
roxy-wi · roxy-wiCVEs relacionadas — roxy-wi
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-43804HIGHOS Command Injection via Port Scan Functionality in Roxy-WIEPSS 2.5%CVE-2026-22265HIGHRoxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCEEPSS 2.3%CVE-2026-27811HIGHRoxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCEEPSS 2.1%CVE-2026-33076HIGHRoxy-WI vulnerable to path traversal and arbitrary file writingEPSS 0.8%CVE-2026-33208HIGHRoxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config EndpointEPSS 0.7%CVE-2026-45558CRITICALRoxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section saveEPSS 0.4%