CVE-2026-33432: Roxy-wi Auth Bypass Vulnerability

CVE-2026-33432 Overview

CVE-2026-33432 is an LDAP injection vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw exists in versions up to and including 8.2.8.2 when Lightweight Directory Access Protocol (LDAP) authentication is enabled. Roxy-WI constructs the LDAP search filter by concatenating the user-supplied login name directly into the query string without escaping LDAP special characters. An unauthenticated attacker can inject filter metacharacters into the username field to manipulate the directory query and bypass authentication. No patched version is available at the time of publication.

Critical Impact
Unauthenticated attackers can bypass LDAP authentication and gain administrative access to Roxy-WI without knowing a valid password.

Affected Products

Roxy-WI versions up to and including 8.2.8.2
Deployments where LDAP authentication is enabled
Roxy-WI instances managing HAProxy, Nginx, Apache, and Keepalived

Discovery Timeline

2026-04-20 - CVE-2026-33432 published to the National Vulnerability Database
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-33432

Vulnerability Analysis

The vulnerability resides in the Roxy-WI authentication module located at app/modules/roxywi/auth.py. When LDAP authentication is configured, the application accepts a login username from the HTTP login form and inserts that value directly into the LDAP search filter sent to the directory server. Because the input is not escaped or validated for LDAP metacharacters such as *, (, ), |, &, and \, the attacker controls the structure of the filter expression itself, not just a value within it. This authentication weakness is categorized under [CWE-287] (Improper Authentication) and represents a textbook LDAP injection condition.

Root Cause

The root cause is unsafe string concatenation when building the LDAP search filter. Secure LDAP clients escape user input according to RFC 4515 before embedding it in a filter. Roxy-WI omits this step, allowing crafted input to alter the boolean logic of the query. The directory then returns user entries the application did not intend to match, and the authentication routine accepts the result as a successful bind context.

Attack Vector

The attack is remote, network-accessible, and requires no prior credentials or user interaction. An attacker submits a malicious value in the username field of the Roxy-WI login form. Injecting a wildcard such as *)(uid=* collapses the filter into one that matches any account, causing the directory to return a valid user entry. The application then treats the attacker as that authenticated user. Technical details are documented in the GHSA-hv3x-4w38-r92m advisory and the vulnerable authentication source.

Detection Methods for CVE-2026-33432

Indicators of Compromise

Login attempts containing LDAP metacharacters such as *, (, ), |, or \ in the username field of Roxy-WI authentication requests
Successful authentication events to Roxy-WI followed by administrative actions from unfamiliar source addresses
LDAP server query logs showing unusually broad or malformed search filters originating from the Roxy-WI service account
Anomalous configuration changes to HAProxy, Nginx, Apache, or Keepalived managed through Roxy-WI

Detection Strategies

Inspect Roxy-WI web access logs for POST requests to the login endpoint containing LDAP filter syntax in the username parameter
Correlate directory server query logs with Roxy-WI authentication events to identify wildcard or boolean injection patterns
Alert on Roxy-WI sessions that authenticate successfully without a preceding password complexity or brute-force pattern

Monitoring Recommendations

Centralize Roxy-WI application logs and LDAP bind logs in a SIEM for correlation
Baseline normal login filter shapes and flag deviations introducing additional parentheses or wildcards
Monitor outbound LDAP queries from the Roxy-WI host for filters that match more than a single user entry

How to Mitigate CVE-2026-33432

Immediate Actions Required

Disable LDAP authentication in Roxy-WI until a fixed release is available and fall back to local authentication with strong passwords
Restrict network access to the Roxy-WI management interface using firewall rules or a VPN, exposing it only to trusted administrators
Audit Roxy-WI user sessions and recent configuration changes for signs of unauthorized access
Rotate credentials and session tokens for any account that may have been impersonated through the LDAP bind

Patch Information

As of the publication date of CVE-2026-33432, no patched version of Roxy-WI is available. Monitor the official Roxy-WI security advisory GHSA-hv3x-4w38-r92m for release updates and apply the fix as soon as the maintainers publish a patched build.

Workarounds

Place Roxy-WI behind a reverse proxy or web application firewall that rejects login requests containing LDAP filter metacharacters such as *, (, ), |, &, and \
Limit the Roxy-WI LDAP service account to a narrow search base and read-only permissions to reduce the impact of injected queries
Enforce IP allowlisting on the management interface so only administrator workstations or jump hosts can reach the login page

bash

# Example nginx reverse proxy rule rejecting LDAP metacharacters in the login username
location /app/login {
    if ($arg_username ~* "[\*\(\)\|\&\\]") {
        return 400;
    }
    proxy_pass http://roxywi_backend;
}