CVE-2026-33432

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without escaping LDAP special characters. An unauthenticated attacker can inject LDAP filter metacharacters into the username field to manipulate the search query, cause the directory to return an unintended user entry, and bypass authentication entirely — gaining access to the application without knowing any valid password. As of time of publication, no known patches are available.

• CWE-287

• https://github.com/roxy-wi/roxy-wi/blob/v8.2.8.2/app/modules/roxywi/auth.pyProduct
• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92mExploit, Vendor Advisory
• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92mExploit, Vendor Advisory

Published

Apr 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33427Discourse is an open-source discussion platform. Prior to ve…7.5
• CVE-2026-33428Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2026-33429Parse Server is an open source backend that can be deployed …5.3
• CVE-2026-3343A reflected cross-site scripting (XSS) vulnerability in the …6.1
• CVE-2026-33430Briefcase is a tool for converting a Python project into a s…7.3
• CVE-2026-33431Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…6.5
• CVE-2026-33433Traefik is an HTTP reverse proxy and load balancer. Prior to…8.8
• CVE-2026-33434Wazuh is a free and open source platform used for threat pre…7.1
• CVE-2026-33435Weblate is a web based localization tool. In versions prior …8
• CVE-2026-33436Stirling-PDF is a locally hosted web application that facili…6.1
• CVE-2026-33438Stirling-PDF is a locally hosted web application that allows…6.5
• CVE-2026-33439Open Access Management (OpenAM) is an access management solu…9.8