CVE-2026-45559 Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only)
An admin can inject LDAP filters via the username parameter to enumerate or harvest user attributes outside the intended record.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45559?
CVE-2026-45559 is a medium-severity vulnerability in roxy-wi, published on 10 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, get_ldap_email (app/modules/roxywi/user.py:120-157) builds the LDAP search filter via f-string concatenation. The username URL path parameter is taken verbatim — no checkAjaxInput, no LDAP escape — and inserted, a username like *)(mail=*)(cn=* injects additional clauses, allowing the admin to enumerate or harvest attributes outside the intended record. At time of publication, there are no publicly available patches.
Weakness: CWE-90
Which versions are affected by CVE-2026-45559?
How do I fix CVE-2026-45559?
No fix has been published for CVE-2026-45559 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-45559 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45559 exists.
Sources
Also known as GHSA-2257-7mhp-grqp.