PT-2026-33226 · Mitmproxy · Mitmproxy

Published 2026-04-14 · Updated 2026-04-26 · CVE-2026-40606

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mitmproxy versions prior to 12.2.2

Description The builtin LDAP proxy authentication fails to correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication. This issue only affects instances using the proxyauth option with LDAP, which is not enabled by default.

Recommendations Update to version 12.2.2 or above. As a temporary workaround, disable the proxyauth option with LDAP to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2026-40606

GHSA-527G-3W9M-29HV

OPENSUSE-SU-2026:10622-1

PYSEC-2026-92

Affected Products

Mitmproxy

References · 14

• https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-527g-3w9m-29hv · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40606 · Security Note
• https://ubuntu.com/security/CVE-2026-40606 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-527g-3w9m-29hv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40606 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10622-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40606 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40606 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-92 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40606 · Vendor Advisory
• https://github.com/mitmproxy/mitmproxy/commit/71c9234057922bc29b9734ec408d712113d294d2 · Note
• https://github.com/mitmproxy/mitmproxy · Note
• https://suse.com/security/cve/CVE-2026-40606 · Note
• https://twitter.com/CVEnew/status/2046675005031747636 · Twitter Post