CVE-2026-33432

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33432", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-19T18:45:22.435Z", "datePublished": "2026-04-20T20:26:52.217Z", "dateUpdated": "2026-04-21T17:38:09.523Z"}, "containers": {"cna": {"title": "Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m"}, {"name": "https://github.com/roxy-wi/roxy-wi/blob/v8.2.8.2/app/modules/roxywi/auth.py", "tags": ["x_refsource_MISC"], "url": "https://github.com/roxy-wi/roxy-wi/blob/v8.2.8.2/app/modules/roxywi/auth.py"}], "affected": [{"vendor": "roxy-wi", "product": "roxy-wi", "versions": [{"version": "<= 8.2.8.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-20T20:26:52.217Z"}, "descriptions": [{"lang": "en", "value": "Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without escaping LDAP special characters. An unauthenticated attacker can inject LDAP filter metacharacters into the username field to manipulate the search query, cause the directory to return an unintended user entry, and bypass authentication entirely \u2014 gaining access to the application without knowing any valid password. As of time of publication, no known patches are available."}], "source": {"advisory": "GHSA-hv3x-4w38-r92m", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-21T17:37:36.446871Z", "id": "CVE-2026-33432", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-21T17:38:09.523Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass", "source": {"advisory": "GHSA-hv3x-4w38-r92m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "roxy-wi", "product": "roxy-wi", "versions": [{"status": "affected", "version": "<= 8.2.8.2"}]}], "references": [{"url": "https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m", "name": "https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/roxy-wi/roxy-wi/blob/v8.2.8.2/app/modules/roxywi/auth.py", "name": "https://github.com/roxy-wi/roxy-wi/blob/v8.2.8.2/app/modules/roxywi/auth.py", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without escaping LDAP special characters. An unauthenticated attacker can inject LDAP filter metacharacters into the username field to manipulate the search query, cause the directory to return an unintended user entry, and bypass authentication entirely \u2014 gaining access to the application without knowing any valid password. As of time of publication, no known patches are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-20T20:26:52.217Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33432", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T17:37:36.446871Z"}}}], "references": [{"url": "https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-21T17:38:00.502Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-33432", "state": "PUBLISHED", "dateUpdated": "2026-04-20T20:26:52.217Z", "dateReserved": "2026-03-19T18:45:22.435Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-20T20:26:52.217Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "roxy-wi", "vendor": "roxy-wi", "versions": [{"status": "affected", "version": "<= 8.2.8.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*", "matchCriteriaId": "E3F03A84-592D-4BAB-9D78-43D9E973DFDE", "versionEndIncluding": "8.2.8.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without escaping LDAP special characters. An unauthenticated attacker can inject LDAP filter metacharacters into the username field to manipulate the search query, cause the directory to return an unintended user entry, and bypass authentication entirely \u2014 gaining access to the application without knowing any valid password. As of time of publication, no known patches are available."}, {"lang": "es", "value": "Roxy-WI es una interfaz web para gestionar servidores Haproxy, Nginx, Apache y Keepalived. En versiones hasta la 8.2.8.2 inclusive, cuando la autenticaci\u00f3n LDAP est\u00e1 habilitada, Roxy-WI construye un filtro de b\u00fasqueda LDAP concatenando directamente el nombre de usuario de inicio de sesi\u00f3n proporcionado por el usuario en la cadena del filtro sin escapar los caracteres especiales de LDAP. Un atacante no autenticado puede inyectar metacaracteres de filtro LDAP en el campo de nombre de usuario para manipular la consulta de b\u00fasqueda, hacer que el directorio devuelva una entrada de usuario no deseada y eludir la autenticaci\u00f3n por completo - obteniendo acceso a la aplicaci\u00f3n sin conocer ninguna contrase\u00f1a v\u00e1lida. En el momento de la publicaci\u00f3n, no hay parches conocidos disponibles."}], "id": "CVE-2026-33432", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33432", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-21T17:37:36.446871Z", "version": "2.0.3"}}]}, "published": "2026-04-20T21:16:34.970", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/roxy-wi/roxy-wi/blob/v8.2.8.2/app/modules/roxywi/auth.py"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.2.8.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "roxy-wi", "source": "cna", "vendor": "roxy-wi"}, "product": "roxy-wi", "vendor": "roxy-wi"}], "analysis": {"en": {"generated_at": "2026-04-28T16:19:55.322592+00:00", "value": {"mitigation_remediation": ["Disable LDAP authentication entirely if it is not essential for operation, or restrict access to the login page to trusted IP ranges.", "Apply a defensive coding change by editing the auth.py file to properly escape or sanitize LDAP filter metacharacters before constructing the search filter.", "Monitor authentication logs for abnormal patterns of injected characters or repeated failed login attempts, and react promptly to any suspicious activity.", "Keep the application under continuous review of vendor notices and update to any future version that addresses the flaw as soon as a patch is released."], "summary": {"action": "Apply Mitigation", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The affected product is Roxy-WI, managed by the roxy-wi vendor. The issue is present in all versions up to and including 8.2.8.2. No official patch or workaround has been released by the vendor at the time of publication, and the vulnerability is not listed in the CISA KEV catalog.", "description_and_impact": "The vulnerability arises when Roxy-WI, if LDAP authentication is activated, concatenates a user-supplied login string directly into an LDAP search filter without escaping special characters. An unauthenticated attacker can inject LDAP meta-characters into the username field, causing the search operation to return an unintended directory entry and thereby bypass authentication. As a result, the attacker gains authenticated access to the application\u2019s interface, potentially with full administrative privileges. This flaw is classified as CWE-287 and is reflected in a CVSS score of 7.7.", "risk_and_exploitability": "With an unauthenticated attack vector and a CVSS score of 7.7, the technical severity is high. The EPSS score of 0.00142 (below 1%) indicates a very low probability of real-world exploitation, but the vulnerability\u2019s lack of a patch and its straightforward injection mechanism still allow skilled attackers to use it. Since it is not listed in CISA KEV, no widespread active exploits have been observed, yet the potential for targeted attacks exists. Protective action remains necessary through disabling LDAP authentication, applying a local code fix, or restricting network access to the Roxy-WI instance."}}}}, "created": "2026-04-20T22:30:19.704846+00:00", "updated": "2026-04-28T16:30:35.090832+00:00", "vendors": ["roxy-wi", "roxy-wi$PRODUCT$roxy-wi"]}