CVE-2026-45567: Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt

Synopsis

Authentication bypass in Roxy-WI (versions 8.2.6.4 and prior) allows an unauthenticated remote attacker to reach protected endpoints by crafting a URL containing the 'api' substring, and to invoke the /api/gpt endpoint without any credentials. The vulnerability is reachable over the network with no authentication required and no victim interaction needed. Successful exploitation gives an attacker read access to data, the ability to modify state, and the ability to disrupt service availability across the managed Haproxy, Nginx, Apache, and Keepalived infrastructure controlled by the Roxy-WI instance. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Roxy-WI web interface over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials are needed; the bypass is triggered by crafting a URL with the 'api' substring or by calling /api/gpt directly.

• Victim interactionNot required

  The attacker sends requests directly to the server and no user action or social engineering is required to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and condition-free, requiring only a crafted HTTP request with no race conditions or environmental dependencies.

Blast Radius

• Reads application data and configuration details exposed through bypassed authenticated endpoints, including information about managed Haproxy, Nginx, Apache, and Keepalived servers.
• Modifies server configurations or state through write-capable API endpoints that become accessible after the authentication check is bypassed.
• Disrupts availability of the Roxy-WI management interface or of the servers it controls by issuing unauthorized commands through the exposed API surface.
• Invokes the /api/gpt endpoint without credentials, potentially leaking sensitive prompt data or consuming backend AI service quotas tied to the deployment.