Unvalidated HAProxy Configuration Injection in Roxy-WI

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy/<server_id>/section/<section_type> and the PUT / global / defaults variants) accept a JSON option field that is not validated, not escaped, and is rendered verbatim into the generated HAProxy configuration via the section.j2, global.j2, and defaults.j2 Ansible templates. Because Roxy-WI then pushes the generated config to the load balancer and runs systemctl reload haproxy, an authenticated user with role ≤ 3 (user) can inject arbitrary HAProxy directives into the config that runs on every load balancer their group manages — including option external-check + external-check command /bin/bash -c '…', which gives remote code execution on the load balancer as the haproxy user on every health-check tick. At time of publication, there are no publicly available patches.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Roxy-WI versions 8.2.6.4 and earlier contain a critical input validation vulnerability in HAProxy configuration management endpoints. The POST and PUT APIs for section-save operations accept JSON option fields that are passed directly into Ansible templates without sanitization or escaping, enabling attackers to inject arbitrary HAProxy directives. This vulnerability affects organizations using Roxy-WI to manage load balancers and reverse proxies—critical infrastructure components handling substantial traffic volumes. An authenticated or unauthenticated attacker (depending on deployment) can manipulate configuration generation to achieve remote code execution on managed HAProxy, Nginx, Apache, and Keepalived servers, potentially compromising entire infrastructure segments.

Casky's 419 mapped skills detect this attack pattern by analyzing the MITRE ATT&CK techniques embedded in the vulnerability: TA0001 (Initial Access) through malicious API requests, TA0043 (Reconnaissance) via endpoint enumeration, and TA0002 (Execution) through command injection in configuration payloads. Practitioners using Casky would observe findings showing CWE-20 (improper input validation) and CWE-78 (OS command injection) patterns in request/response telemetry, with Claude's extended reasoning identifying the template injection mechanism in section.j2, global.j2, and defaults.j2 files. The skill coverage flags suspicious JSON payloads containing shell metacharacters, directive syntax anomalies, and configuration directives that deviate from legitimate HAProxy schemas—enabling detection before malicious configs reach production servers.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-45558.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-45558

Casky has 419 skills that investigate the attack patterns behind CVE-2026-45558. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn