← Vulnerability feed

Vulnerability record · CVE-2026-33432 · published 20 April 2026

CVE-2026-33432: Roxy-wi improper authentication vulnerability

Roxy Wi · Roxy Wi

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without escaping LDAP special characters. An unauthenticated attacker can inject LDAP filter metacharacters into the username field to manipulate the search query, cause the directory to return an unintended user entry, and bypass authentication entirely — gaining access to the application without knowing any valid password. As of time of publication, no known patches are available.

7.7 CVSS 4.0 High EPSS 0.56% · top 55.7% CWE-287 · Improper authentication
7.7CVSS 4.0 base score
0.56%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without escaping LDAP special characters. An unauthenticated attacker can inject LDAP filter metacharacters into the username field to manipulate the search query, cause the directory to return an unintended user entry, and bypass authentication entirely — gaining access to the application without knowing any valid password. As of time of publication, no known patches are available.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/roxy-wi/roxy-wi/blob/v8.2.8.2/app/modules/roxywi/auth.py Product
https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m ExploitVendor Advisory
https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m ExploitVendor Advisory

Track CVE-2026-33432 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-31161Roxy-wi command injection vulnerabilityRoxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via t…EPSS 28%9.8CVE-2022-31137Roxy-WI unauthenticated OS command injection in options.pyRoxy-WI versions before 6.1.1.0 pass user-supplied input into the subprocess_execute function in /app/options.py without sanitisation, allowing OS co…EPSS 91%analysed9.8CVE-2022-31125Roxy-wi improper authentication vulnerabilityRoxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unaut…EPSS 20%9.8CVE-2022-31126Roxy-wi unauthenticated remote code execution via options.py injectionRoxy-wi, an open source web interface for managing HAProxy, Nginx, Apache and Keepalived, contains an injection flaw (CWE-74) in /app/options.py. A r…EPSS 53%analysed9.8CVE-2021-38167Roxy-wi sql injection vulnerabilityRoxy-WI through 5.2.2.0 allows SQL Injection via check_login. An unauthenticated attacker can extract a valid uuid to bypass authentication.EPSS 1.3%8.9CVE-2026-33076Roxy-wi path traversal vulnerabilityRoxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the haproxy_section_save interface p…EPSS 1.0%8.9CVE-2026-33078Roxy-wi sql injection vulnerabilityRoxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability i…EPSS 0.52%8.8CVE-2026-27811Roxy-wi command injection vulnerabilityRoxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability ex…EPSS 3.0%

Source: NIST National Vulnerability Database (record CVE-2026-33432), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.