Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated… (CVE-2026-55202)
Description
Tinyproxy versions through 1.11.3 contain a vulnerability in the validation of the Host header during stathost detection. This flaw allows unauthenticated remote attackers to access the proxy's internal statistics page by injecting a matching Host header or bypass detection via port manipulation. The vulnerability can also cause misrouting of requests as transparent proxy connections, potentially circumventing access controls. The issue was fixed in commit 09312a1.
CVSS v3.1
Score 8.2high
Affected software
pkg:deb/ubuntu/tinyproxy?arch=source&distro=esm-infra-legacy/trustypkg:deb/ubuntu/tinyproxy?arch=source&distro=esm-apps/xenialpkg:deb/ubuntu/tinyproxy?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/tinyproxy?arch=source&distro=focalpkg:deb/ubuntu/tinyproxy?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/tinyproxy?arch=source&distro=noblepkg:deb/ubuntu/tinyproxy?arch=source&distro=questingpkg:deb/ubuntu/tinyproxy?arch=source&distro=stonkingpkg:deb/ubuntu/tinyproxy?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Tinyproxy versions up to and including 1.11.3 improperly validate the Host header during stathost detection. This allows unauthenticated attackers to gain unauthorized access to the internal proxy statistics page by injecting a matching Host header or by manipulating ports to bypass detection. Additionally, attackers can cause requests to be misrouted as transparent proxy connections, enabling circumvention of access controls. The vulnerability is addressed in commit 09312a1.
Potential Impact
Remote unauthenticated attackers can access internal proxy statistics pages and potentially bypass access controls by exploiting improper Host header validation. This could lead to information disclosure (high confidentiality impact) and limited integrity impact due to misrouting of requests. Availability is not affected.
Mitigation Recommendations
A fix is available and was introduced in commit 09312a1. Users should upgrade Tinyproxy to a version that includes this commit. No other mitigation is indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-55202
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:14.04:LTS","Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:25.10","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
Threat ID: 6ad3f5f32cdf04f656663527
Added to database: 10/17/2026, 22:25:55 UTC
Last enriched: 10/18/2026, 00:46:41 UTC
Last updated: 10/18/2026, 00:46:41 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.