The vulnerability exists in the Roxy-WI web interface in versions 8.2.6.4 and prior, where the /smon/agent routes accept any path component and forward it directly to a backend agent using requests.get. This behavior permits attacker-controlled values to be used as target hosts, including private, loopback, and cloud metadata addresses. The weakness enables retrieval of sensitive internal data or credentials from the agent process, resulting in confidentiality compromise without authentication due to the open endpoint. The weakness is classified as CWE‑918.

Roxy-WI installations running version 8.2.6.4 or earlier are affected, regardless of deployment environment. The issue is present in all supported control panels for HAProxy, Nginx, Apache and Keepalived managed by Roxy‑WI.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available and the vulnerability is currently not listed in the CISA KEV catalog, but the lack of input validation makes it exploitable from any host that can reach the vulnerable web interface. The attacker would need network connectivity to the Roxy‑WI instance; otherwise the flaw cannot be triggered. Because the flaw allows unrestricted access to internal network resources, the potential impact can be significant if the attacker can reach the agent endpoint from a compromised host or from an external source with network access to the Roxy‑WI service.