What is the CVSS score of CVE-2026-40606?

CVE-2026-40606 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40606?

Yes, a patch is available for CVE-2026-40606. Update the affected software to the latest version immediately.

mitmproxy CVE-2026-40606

MEDIUM

LDAP Injection (CWE-90)

2026-04-21 security-advisories@github.com

Authentication Bypass LDAP Code Injection Suse

4.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

SUSE

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 21, 2026 - 20:30 nvd

Patch available

Analysis Generated

Apr 21, 2026 - 18:49 vuln.today

Analysis Generated

Apr 21, 2026 - 18:22 vuln.today

CVE Published

Apr 21, 2026 - 18:16 nvd

MEDIUM 4.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on mitmproxy (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 12.2.2.

DescriptionGitHub Advisory

mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication. Only mitmproxy instances using the proxyauth option with LDAP are affected. This option is not enabled by default. The vulnerability has been fixed in mitmproxy 12.2.2 and above.

AnalysisAI

Authentication bypass in mitmproxy 12.2.1 and below allows remote attackers to bypass LDAP-based proxy authentication through unsanitized username injection. The vulnerability affects only instances explicitly configured with the proxyauth option using LDAP authentication, which is disabled by default. Attackers can exploit this over the network without authentication or user interaction to gain unauthorized access to proxied connections.

Technical ContextAI

mitmproxy's builtin LDAP proxy authentication mechanism (enabled via the proxyauth option with LDAP configuration) constructs LDAP queries using client-supplied usernames without proper sanitization. The vulnerability root cause is CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query), allowing attackers to inject LDAP filter syntax into authentication queries. This enables bypassing the authentication check by manipulating the LDAP filter logic, similar to SQL injection attacks but targeting LDAP directory services. The affected component is the LDAP authentication handler in mitmproxy's proxy authentication subsystem.

RemediationAI

Upgrade mitmproxy to version 12.2.2 or above, which contains the fix for LDAP username sanitization. Organizations unable to upgrade immediately should disable the proxyauth LDAP feature if not critical to operations, or implement a non-LDAP authentication method. Additional compensating controls include restricting network access to the mitmproxy proxy port using firewall rules to limit which clients can reach the authentication endpoint, though this may impact legitimate use cases. Verify the upgrade using the GitHub security advisory GHSA-527g-3w9m-29hv.