CVE-2026-45559: Roxy-WI LDAP Injection Vulnerability

CVE-2026-45559 Overview

CVE-2026-45559 is an LDAP injection vulnerability in Roxy-WI, a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. The flaw affects versions 8.2.6.4 and prior. The get_ldap_email function in app/modules/roxywi/user.py (lines 120-157) constructs LDAP search filters using f-string concatenation. The username URL path parameter is inserted verbatim without invoking checkAjaxInput or applying LDAP escape routines. An authenticated administrator can submit a username such as *)(mail=*)(cn=* to inject additional filter clauses and enumerate attributes outside the intended record.

Critical Impact
An attacker with administrative privileges can manipulate LDAP search filters to harvest directory attributes beyond the targeted user record, leading to confidentiality loss across the directory service.

Affected Products

Roxy-WI versions 8.2.6.4 and prior
Deployments integrating Roxy-WI with LDAP authentication backends
Web management consoles for Haproxy, Nginx, Apache, and Keepalived using Roxy-WI

Discovery Timeline

2026-06-10 - CVE-2026-45559 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45559

Vulnerability Analysis

The vulnerability resides in the get_ldap_email function within app/modules/roxywi/user.py. This function retrieves a user's email address from an LDAP directory by building a search filter dynamically. The implementation uses Python f-string concatenation to embed the supplied username directly into the filter expression. Roxy-WI exposes the username through a URL path parameter that the application passes to the LDAP search without sanitization or escaping.

LDAP filter syntax treats characters such as *, (, ), \, and NUL as control metacharacters. When unsanitized input reaches the filter string, an attacker can inject additional logical clauses. A crafted username like *)(mail=*)(cn=* closes the original clause and appends attacker-controlled predicates. The result is an LDAP search that returns records and attributes the requesting user was never intended to retrieve. This pattern aligns with CWE-90: Improper Neutralization of Special Elements used in an LDAP Query.

Root Cause

The root cause is the absence of input validation and LDAP-specific escaping in the get_ldap_email code path. The function bypasses the checkAjaxInput helper used elsewhere in Roxy-WI and does not apply RFC 4515 escape rules to filter assertion values. Trust in the URL-supplied username allows attacker-controlled metacharacters to alter filter semantics.

Attack Vector

Exploitation requires high privileges because the affected endpoint is reachable only by authenticated administrators. An attacker submits an HTTP request to the relevant Roxy-WI route with a maliciously crafted username segment. The injected payload restructures the LDAP filter and causes the directory server to return data outside the intended scope, including arbitrary attributes mapped by additional filter clauses.

The vulnerability manifests when the application concatenates the URL parameter into the filter string. Refer to the GitHub Security Advisory GHSA-2257-7mhp-grqp for the affected source range and reproduction notes.

Detection Methods for CVE-2026-45559

Indicators of Compromise

HTTP requests to Roxy-WI endpoints containing LDAP metacharacters such as *, (, ), or \ in the username path segment
Unusual LDAP search filters logged on the directory server containing multiple (attribute=value) clauses originating from the Roxy-WI service account
LDAP queries returning unexpectedly large attribute sets or unrelated user records correlated with Roxy-WI admin sessions

Detection Strategies

Inspect Roxy-WI web access logs for username path parameters containing LDAP filter metacharacters or URL-encoded equivalents (%2A, %28, %29)
Correlate Roxy-WI administrative actions with directory server query logs to identify filters that deviate from the expected single-clause structure
Alert on get_ldap_email invocations whose constructed filter strings contain more than one assertion clause

Monitoring Recommendations

Forward Roxy-WI application logs and LDAP server query logs into a centralized analytics platform for correlation
Enable verbose LDAP audit logging on directory servers to capture full filter strings issued by the Roxy-WI bind account
Track administrative authentication events in Roxy-WI to scope which accounts can reach the vulnerable code path

How to Mitigate CVE-2026-45559

Immediate Actions Required

Restrict Roxy-WI administrative console access to trusted networks and a minimal set of trusted administrators
Rotate any LDAP bind credentials configured in Roxy-WI if abuse is suspected
Reduce the privileges of the LDAP service account used by Roxy-WI to limit attribute exposure during a successful injection

Patch Information

At the time of publication, no official patch is available for CVE-2026-45559. Monitor the Roxy-WI GitHub Security Advisory GHSA-2257-7mhp-grqp for fix availability covering versions after 8.2.6.4.

Workarounds

Disable the LDAP authentication integration in Roxy-WI until a vendor patch is released, where operationally feasible
Place a reverse proxy or web application firewall in front of Roxy-WI to block requests containing LDAP metacharacters in the username path segment
Limit which administrator accounts can invoke endpoints that resolve to get_ldap_email through network ACLs or authentication gateways

bash

# Example WAF rule concept: reject LDAP metacharacters in the username path segment
# (adapt to your WAF syntax)
location ~ ^/.*/user/.* {
    if ($request_uri ~* "[\*\(\)\\]|%2[a8]|%29|%5c") {
        return 400;
    }
}