CVE-2026-45552

creationtimestamp| type| source ---|---|--- 2026-06-10 18:05:44+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnxcftj7pj2b...

CVE-2026-45552 Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.beforerequest → @jwtrequired app/routes/install/routes.py:36-39. The individual endpoints installexporter, installwaf, installgeoip,...