CVE-2026-33078 is a critical (CVSS 9.8) SQL injection in Roxy-WI, the web interface for HAProxy, Nginx, Apache and Keepalived. Before 8.2.6.4, the server_ip value in the HAProxy section save endpoint reaches a SQL query unescaped, so a request can run arbitrary SQL. Upgrade to 8.2.6.4 or later.
What's affected
The NVD record says versions before 8.2.6.4 are affected and 8.2.6.4 fixes the issue. The GitHub advisory lists pip package roxy-wi at 8.2.6.3 and earlier, with no patched version shown in its summary. Confirm the fixed release in the project's release notes.
How to check if you're exposed
For a pip install:
pip show roxy-wi
Otherwise read the version from the Roxy-WI interface or your deployment files. Also check which networks can reach the web interface. The CVSS vector lists network access, no privileges and no user interaction.
What to do now
- Upgrade Roxy-WI to 8.2.6.4 or later.
- Until then, keep the interface off the public internet and allow only trusted addresses.
- Review the Roxy-WI database and web logs for unusual requests to the section save route.
- Rotate credentials held in the Roxy-WI database if you suspect misuse.
Why it matters
The weakness class is CWE-89. The advisory traces a value from the URL path through several function calls into a query that is built with Python string formatting instead of bound parameters. Anything in that value becomes part of the SQL text.
A management tool like this stores server inventory and access details, so database control has consequences beyond the app itself. The same endpoint also has a path traversal flaw, CVE-2026-33076, fixed in the same release. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
How do developers prevent this class of bug?
Pass values to the database as bound parameters rather than formatting them into the query string, and validate inputs such as IP addresses before use.
Sources
Last reviewed: 19 October 2026.
