CVE-2026-45559: Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only)
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, getldapemail (app/modules/roxywi/user.py:120-157) builds the LDAP search filter via f-string concatenation. The username URL path parameter is taken verbatim — no checkAjaxInput, no LDAP escape — and inserted, a username like )(mail=)(cn= injects additional clauses, allowing the admin to enumerate or harvest attributes outside the intended record. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply proper LDAP escaping to the username path parameter before building the LDAP search filter in get_ldap_email (app/modules/roxywi/user.py:120-157) to prevent LDAP injection.
Roxy-WI (app/modules/roxywi/user.py - get_ldap_email) ldap_escape_username = true - Configuration
Invoke or implement input validation (e.g. call checkAjaxInput or equivalent) on the username URL path parameter to reject/normalize malicious characters before it is concatenated into the LDAP filter.
Roxy-WI (app/modules/roxywi/user.py - get_ldap_email) validate_ajax_input = true - Compensating control
Restrict access to the /user/ldap/<username> admin endpoint and the Roxy-WI admin interface to trusted IP addresses or network segments using firewall rules, ACLs, or a management-only network until a patch is available.
- Operational
Audit LDAP queries and Roxy-WI admin logs for use of /user/ldap/<username> and for signs of attribute enumeration or data harvesting; if suspicious activity is found, investigate and take recovery steps (e.g., revoke/rotate affected credentials or service accounts).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45559?
CVE-2026-45559 has a medium severity score of 4.9.
How does CVE-2026-45559 affect Roxy-WI?
CVE-2026-45559 allows for LDAP injection via the username URL path parameter, potentially leading to unauthorized data exposure.
Who is affected by CVE-2026-45559?
Administrators using Roxy-WI versions 8.2.6.4 and prior are affected by CVE-2026-45559.
What is the recommended fix for CVE-2026-45559?
Upgrade Roxy-WI to the latest version that addresses CVE-2026-45559 to prevent LDAP injection.
What is the exploitation vector for CVE-2026-45559?
CVE-2026-45559 can be exploited remotely by submitting crafted usernames directly in the URL path.