LDAP Injection Vulnerability in Roxy-WI Web Interface by Roxy-WI

CVE-2026-33432

What is CVE-2026-33432?

The Roxy-WI web interface, which is designed for managing Haproxy, Nginx, Apache, and Keepalived servers, has a significant security issue related to its LDAP authentication process. In versions up to and including 8.2.8.2, the application fails to properly escape LDAP special characters when constructing search filters based on user input. This oversight allows an unauthenticated attacker to manipulate the LDAP search queries by injecting malicious LDAP filter metacharacters into the username field. Consequently, the attacker can bypass authentication mechanisms and gain unauthorized access to the application without requiring valid credentials. As of the latest information, no patches are available to address this vulnerability, highlighting the urgent need for users to assess their security posture.

References