Roxy-WI: SSRF in /smon/agent// reachable to cloud metadata IPs
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the /smon/agent/{version,uptime,status,checks}/ family of routes takes the URL path component verbatim into requests.get(f'http://{server_ip}:{agent_port}/...'). The path component is constrained only by Flask's default URL converter, which permits any value (including IPv4 literals like 169.254.169.254, RFC1918 ranges, and 127.0.0.1). At time of publication, there are no publicly available patches.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-45561
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 07:34 UTC · Revision 1
Source evidence
Roxy-WI: SSRF in /smon/agent// reachable to cloud metadata IPs
core-osv · Original sourcePublished 10 Jun 2026, 14:03 UTC
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the /smon/agent/{version,uptime,status,checks}/ family of routes takes the URL path component verbatim into requests.get(f'http://{server_ip}:{agent_port}/...'). The path component is constrained only by Flask's default URL converter, which permits any value (including IPv4 literals like 169.254.169.254, RFC1918 ranges, and 127.0.0.1). At time of publication, there are no publicly available patches.
osv:CVE-2026-45561
Complete source record
{
"id": "42f03ab2ce733ae5e1caadbb73135500d79204cdd7a2e50d1ca3d87b7255818f",
"url": "https://osv.dev/vulnerability/CVE-2026-45561",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Roxy-WI: SSRF in /smon/agent// reachable to cloud metadata IPs",
"summary": "Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the /smon/agent/{version,uptime,status,checks}/ family of routes takes the URL path component verbatim into requests.get(f'http://{server_ip}:{agent_port}/...'). The path component is constrained only by Flask's default URL converter, which permits any value (including IPv4 literals like 169.254.169.254, RFC1918 ranges, and 127.0.0.1). At time of publication, there are no publicly available patches.",
"evidence": "osv:CVE-2026-45561",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-45561",
"aliases": [
"CVE-2026-45561",
"GHSA-2crj-7rqc-x7rq"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/roxy-wi/roxy-wi",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "d72ea494d0bf1ee220fe141625a4298600f624ad"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "8.2.6.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "8.2.6.4"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"v8.2.6.4",
"v8.2.6.3",
"v8.2.8.2",
"v8.2.8.1",
"v8.2.6",
"v8.2.5",
"v8.2.4",
"v8.2.3",
"v8.2.2",
"v8.2.1",
"v8.2.0",
"v8.1.8",
"v8.1.7",
"v8.1.6",
"v8.1.5",
"v8.1.4",
"v8.1.3",
"v8.1.2",
"v8.1.1",
"v8.1.0.1",
"v8.1",
"v8.0.2",
"v8.0.1",
"v8.0",
"v7.3.2.0",
"v7.3.1.0",
"v7.3.0.0",
"v7.2.6.0",
"v7.2.5.0",
"v7.2.4.0",
"v7.2.3.0",
"v7.2.2.0",
"v7.2.1.0",
"v7.2.0.0",
"v7.1.2.0",
"v7.1.1.0",
"v7.1.0.0",
"v7.0.4.0",
"v7.0.3.0",
"v7.0.2.0",
"v7.0.1.0",
"v7.0.0.0",
"v6.3.19.0",
"v6.3.18.0",
"v6.3.17.0",
"v6.3.16.0",
"v6.3.15.0",
"v6.3.14.0",
"v6.3.13.0",
"v6.3.12.0",
"v6.3.11.0",
"v6.3.10.0",
"v6.3.9.0",
"v6.3.8.0",
"v6.3.7.0",
"v6.3.6.0",
"v6.3.5.0",
"v6.3.4.0",
"v6.3.3.0",
"v6.3.2.0",
"v6.3.1.0",
"v6.3.0.0",
"v6.2.3.0",
"v6.2.2.0",
"v6.2.1.0",
"v6.2.0.0",
"v6.1.5.0",
"v6.1.4.0",
"v6.1.3.0",
"v6.1.2.0",
"v6.1.1.0",
"v6.1.0.0",
"v6.0.3.0",
"v6.0.2.0",
"v6.0.1.0",
"v6.0.0.0",
"v5.5.1.0",
"v5.5.0.0",
"v5.4.3.0",
"v5.4.2.0",
"v5.4.1.0",
"v5.4.0.0",
"v5.3.6.0",
"v.5.3.5.0",
"v5.3.4.0",
"v5.3.3.0",
"v5.3.2.0",
"v5.3.1.0",
"v5.3.0.0",
"v5.2.6.0",
"v5.2.5.0",
"v5.2.4.0",
"v5.2.3.0",
"v5.2.2.0",
"v5.2.1",
"v5.2.0",
"v5.1.4.0",
"v5.1.1.0",
"v4.4.1.0",
"3.4.5.1",
"3.4.5",
"3.4.4.7",
"3.4.4.6",
"v3.3",
"v3.2.13",
"v2.0.2",
"v1.10.2.1",
"v1.10.2",
"v1.10.1",
"v1.10",
"v1.9.1",
"v1.6",
"v1.4.1",
"v1.4",
"v1.3",
"v1.1",
"v1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45561.json"
}
}
],
"modified": "2026-10-28T02:30:26.870733627Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45561.json",
"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-2crj-7rqc-x7rq",
"https://nvd.nist.gov/vuln/detail/CVE-2026-45561"
],
"provider_metadata": {
"cwe_ids": [
"CWE-918"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45561.json"
}
},
"related_cves": [
{
"value": "CVE-2026-45561",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 493385,
"published_at": "2026-06-10T14:03:03.387+00:00"
}