CVE-2026-45558 Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save
Authenticated users can inject HAProxy directives to achieve remote code execution on managed load balancers via unvalidated configuration fields.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45558?
CVE-2026-45558 is a critical code injection vulnerability in roxy-wi, published on 10 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy/<server_id>/section/<section_type> and the PUT / global / defaults variants) accept a JSON option field that is not validated, not escaped, and is rendered verbatim into the generated HAProxy configuration via the section.j2, global.j2, and defaults.j2 Ansible templates. Because Roxy-WI then pushes the generated config to the load balancer and runs systemctl reload haproxy, an authenticated user with role ≤ 3 (user) can inject arbitrary HAProxy directives into the config that runs on every load balancer their group manages — including option external-check + external-check command /bin/bash -c '…', which gives remote code execution on the load balancer as the haproxy user on every health-check tick. At time of publication, there are no publicly available patches.
Which versions are affected by CVE-2026-45558?
How do I fix CVE-2026-45558?
No fix has been published for CVE-2026-45558 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-45558 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45558 exists.
Sources
Also known as GHSA-w2x4-66jj-3597.