PT-2026-50530 · Tinyproxy · Tinyproxy

Tristan Madani · CVE-2026-55202 · Published 2026-06-17 · Updated 2026-06-23

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Tinyproxy versions prior to 1.11.3 commit 09312a1

Description Improper validation of the Host header during stathost detection allows unauthenticated attackers to access the statistics page by injecting a matching Host header or bypassing detection through port manipulation. This can lead to unauthorized access to internal proxy statistics or the misrouting of requests as transparent proxy connections to circumvent access controls.

Recommendations Update to the version containing commit 09312a1.

Exploit

Fix

HTTP Request/Response Smuggling

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-444

CWE-290

Related Identifiers

CVE-2026-55202

OPENSUSE-SU-2026:11060-1

Affected Products

Tinyproxy

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55202.json · Exploit
• https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-55202 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-55202 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-55202 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-55202 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-55202 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-55202 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:11060-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-55202 · Vendor Advisory
• https://github.com/tinyproxy/tinyproxy · Note
• https://github.com/tinyproxy/tinyproxy/pull/606 · Note
• https://twitter.com/VulmonFeeds/status/2067378978583642586 · Twitter Post
• https://twitter.com/CVEnew/status/2067350981155705327 · Twitter Post
• https://t.me/cveNotify/172625 · Telegram Post