CVE-2026-33432 Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass

High 7.7 Published 20 Apr 2026 Updated 21 Apr 2026

Unauthenticated attackers can bypass authentication in Roxy-WI via LDAP injection when LDAP is enabled, gaining unauthorized access to the management interface.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-33432?

CVE-2026-33432 is a high-severity authentication bypass vulnerability in roxy-wi, published on 20 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without escaping LDAP special characters. An unauthenticated attacker can inject LDAP filter metacharacters into the username field to manipulate the search query, cause the directory to return an unintended user entry, and bypass authentication entirely — gaining access to the application without knowing any valid password. As of time of publication, no known patches are available.

Weakness: CWE-287

Which versions are affected by CVE-2026-33432?

It affects 1 product.

Products include Roxy-Wi Roxy-Wi.

How do I fix CVE-2026-33432?

No fix has been published for CVE-2026-33432 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-33432 being exploited?

There is no known exploitation of CVE-2026-33432 in the wild and no public exploit code.

Sources

Also known as GHSA-hv3x-4w38-r92m.