PT-2026-50530 · Tinyproxy · Tinyproxy

Tristan Madani · Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-55202

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tinyproxy versions prior to 1.11.3 commit 09312a1

Description Improper validation of the Host header during stathost detection allows unauthenticated attackers to access the statistics page by injecting a matching Host header or bypassing detection through port manipulation. This can lead to unauthorized access to internal proxy statistics or the misrouting of requests as transparent proxy connections to circumvent access controls.

Recommendations Update to the version containing commit 09312a1.

Fix

Authentication Bypass by Spoofing

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-290

CWE-444

Related Identifiers

CVE-2026-55202

Affected Products

Tinyproxy

References · 5

• https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce · Patch
• https://github.com/tinyproxy/tinyproxy/pull/606 · Note
• https://twitter.com/CVEnew/status/2067350981155705327 · Twitter Post
• https://vulncheck.com/advisories/evil-winrm-path-traversal-in-download-dir-function · Note
• https://twitter.com/VulmonFeeds/status/2067378978583642586 · Twitter Post