CVE-2026-40606

ProxyAuth Addon LDAP Injection in mitmproxy

State: Published
Severity: 4.8 Medium
Published: Apr 21, 2026
Updated: Apr 22, 2026
Reserved: Apr 14, 2026

Description

mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication. Only mitmproxy instances using the proxyauth option with LDAP are affected. This option is not enabled by default. The vulnerability has been fixed in mitmproxy 12.2.2 and above.

Scores

CVSS	Score	Vector	Source
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Affected Products

Product	Versions
mitmproxymitmproxy	< 12.2.2Affected

References

https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-527g-3w9m-29hv

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.