CVE-2026-55202
Tinyproxy - Stathost Detection Bypass via Host Header Manipulation
- State
- Published
- Severity
- 8.8 High
- Published
- Jun 17, 2026
- Updated
- Oct 29, 2026
- Reserved
- Jun 16, 2026
Description
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-290 Authentication Bypass by Spoofing
Affected Products
| Product | Versions |
|---|---|
tinyproxytinyproxy |
|
References
- Pull Requestissue-tracking
- Patch Commitpatch
- VulnCheck Advisory: Tinyproxy - Stathost Detection Bypass via Host Header Manipulationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.