Compliance Impact

This vulnerability allows authenticated users with low privileges to execute arbitrary code on HAProxy load balancers, potentially leading to full compromise of the load balancer environment.

Such a compromise can result in unauthorized access to sensitive data, including TLS private keys and internal backend services, which may lead to data breaches.

Data breaches and unauthorized access to sensitive information can negatively impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and health-related data.

Therefore, exploitation of this vulnerability could cause violations of these regulations due to inadequate security controls and potential exposure of protected data.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-45558 is a vulnerability in Roxy-WI, a web interface used to manage HAProxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and earlier, the HAProxy section-save endpoints accept a JSON option field that is not validated or escaped. This untrusted input is directly inserted into the HAProxy configuration files via Ansible templates.

Because the configuration is pushed to the load balancer and HAProxy is reloaded, an authenticated user with a role level of 3 or lower (including regular users) can inject arbitrary HAProxy directives. This includes directives like 'option external-check' combined with 'external-check command' that allow remote code execution on the load balancer as the haproxy user during health check intervals.

The root cause is the lack of input validation and escaping in the option fields used in the configuration templates, allowing attackers to inject malicious commands that execute with the privileges of the haproxy user.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to full compromise of the HAProxy load balancer managed by Roxy-WI. An attacker with low-level authenticated access can execute arbitrary commands on the load balancer as the haproxy user.

• Remote code execution on all HAProxy load balancers managed by the attacker's group.
• Potential access to sensitive data such as TLS private keys.
• Ability to disclose sensitive files or load malicious Lua scripts.
• Possibility to launch daemon processes or pivot to other internal hosts if combined with leaked credentials.

The attack requires only low privileges and no user interaction, making it highly dangerous especially in internet-facing deployments.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting HAProxy configuration files generated by Roxy-WI for injected arbitrary directives, especially those involving the 'option external-check' and 'external-check command' directives. Since the injection occurs via the 'option' field in API requests, checking for unexpected or suspicious entries in the HAProxy config files is key.

One practical approach is to search the HAProxy configuration files for the presence of 'external-check command' directives that execute shell commands. For example, you can run the following command on the load balancer to detect suspicious injected commands:

• grep -r --include='*.cfg' 'external-check command' /etc/haproxy/

Additionally, monitoring the /tmp directory or other writable locations for unexpected files created by injected commands (e.g., /tmp/pwned.txt) can help detect exploitation attempts.

Network detection can include monitoring for unusual reloads of the HAProxy service (e.g., systemctl reload haproxy) triggered by configuration changes, or unexpected outbound connections initiated by malicious Lua scripts or commands injected via this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting or disabling the ability of users with role level 3 or lower to modify HAProxy configuration sections via the Roxy-WI interface, as these users can exploit the vulnerability.

Implement input validation to reject newlines and HAProxy-specific characters in the 'option' fields of configuration requests to prevent injection of arbitrary directives.

Avoid using Jinja2 templates that directly interpolate untrusted input for generating HAProxy configuration files. Instead, use safer templating or sanitization methods.

Enforce allow-lists for permitted HAProxy directives in the configuration fields to prevent injection of unauthorized commands.

On the load balancer side, implement syntactic validation of the HAProxy configuration before reloading the service to detect and reject malicious configurations.

Until patches are available, consider limiting access to the Roxy-WI management interface to trusted administrators only and monitor for suspicious activity or configuration changes.

Useful 0 Not Useful 0