CVE-2026-33432

CVE-2026-33432 is an LDAP injection vulnerability affecting Roxy-WI versions up to 8.2.8.2, a web interface used for managing Haproxy, Nginx, Apache, and Keepalived servers. The vulnerability exists in the LDAP authentication module, where user-supplied login credentials are concatenated directly into LDAP search filters without proper escaping of special characters. An unauthenticated attacker can exploit this by injecting LDAP metacharacters into the username field to manipulate the directory search query and bypass authentication entirely, gaining unauthorized access to the application without knowledge of valid credentials. The vulnerability currently has no known patches available. While the CVSS score is not yet assigned, the FAUCET Risk Score of 48.0/100 indicates moderate concern, and there is no evidence of active exploitation or public exploit code availability as of publication. This vulnerability remains relatively low in community attention with minimal EPSS ranking, though it poses a significant authentication bypass risk for affected deployments.