CVE-2026-33432 is a critical (CVSS 9.1) authentication bypass in Roxy-WI, the web interface for HAProxy, Nginx, Apache and Keepalived. When LDAP login is enabled, the username is pasted into an LDAP filter without escaping. The advisory lists no patched version, so limit exposure and watch the project for a fix.
What's affected
- Product: Roxy-WI, distributed via pip.
- The NVD record says versions up to and including 8.2.8.2. The GitHub advisory text we read lists 8.2.6.3 and earlier. The two differ, so treat anything in that range as affected until the maintainers clarify.
- Only installations with LDAP authentication enabled take the vulnerable code path.
- Fixed version: none listed. The record states that no known patches were available at publication.
How to check if you're exposed
Find out whether you run Roxy-WI and which version:
pip show roxy-wi
pip list | grep -i roxy
Then check your Roxy-WI configuration to see whether LDAP authentication is turned on. If it is off, the flawed code is not used for login. Look at your LDAP server logs for unusual search filters containing parentheses or asterisks tied to login attempts.
Paste a lockfile or manifest into the free in-browser dependency scan to see whether Roxy-WI is in your tree. The Gold directory tracks this CVE, and reachability analysis helps you rank it against everything else you have open.
What to do now
- Inventory every Roxy-WI instance and note the version and whether LDAP login is on.
- Put the interface behind a VPN or an IP allowlist so it is not reachable from the internet.
- If you can, switch to local authentication until a fix ships. This follows from how the flaw works and is not a vendor instruction.
- Review LDAP and application logs for odd usernames and for logins you cannot explain.
- Follow the GitHub advisory and upgrade as soon as a patched release appears.
Why it matters
The cause is a classic injection. Roxy-WI builds the LDAP search filter by joining the login name into the string. A user who types filter characters into the username field can change what the directory returns, so the application ends up authenticating against an entry the attacker never owned. That is CWE-287, improper authentication, reached through unescaped input.
The advisory notes that the Python ldap library offers ldap.filter.escape_filter_chars(), which the code does not call. The tool manages load balancers and web servers, so a bypass here can open the door to the systems behind it. This CVE is not in the CISA KEV catalog.
Quick check
Is there a patched version of Roxy-WI for CVE-2026-33432?
Not in the sources we read. The record says no patches were available at publication, and the advisory lists none. Check the project page for updates.
Sources
- https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m
- https://github.com/roxy-wi/roxy-wi/blob/v8.2.8.2/app/modules/roxywi/auth.py
- https://nvd.nist.gov/vuln/detail/CVE-2026-33432
Last reviewed: 19 October 2026.
