mitmproxy CVE-2026-40606

The LDAP proxyauth option must be explicitly enabled and configured in mitmproxy. Specifically, the proxyauth setting must use LDAP as the authentication backend, which is NOT the default configuration. Remote attackers can connect to the proxy port without pre-existing authentication, and the vulnerability exploits the LDAP filter construction during the authentication handshake. Non-LDAP authentication methods and default configurations (proxyauth disabled) are not affected. The attack occurs during the client's initial connection and authentication phase.

This vulnerability presents moderate risk with important context: CVSS 4.8 with network attack vector (AV:N), high complexity (AC:H), no privileges required (PR:N), and no user interaction needed reflects the baseline severity. However, the real-world risk is significantly constrained by the fact that the LDAP proxyauth option is not enabled by default-only organizations that have explicitly configured LDAP authentication are affected. The AC:H (high complexity) rating suggests the exploitation requires specific conditions or crafted input, which aligns with the LDAP injection nature. No KEV status or active exploitation data is provided, indicating this may be a responsibly disclosed vulnerability without public active exploitation at time of analysis. Organizations using default mitmproxy configurations face zero risk; those using LDAP authentication should prioritize patching. The combination of network accessibility but non-default configuration makes this a targeted rather than widespread risk.

An attacker crafts a malicious LDAP filter string as the username when connecting to a mitmproxy instance configured with LDAP proxyauth (e.g., username: 'admin*)(|(uid=*' or similar injection payload). The unsanitized username is inserted into the LDAP query, modifying the filter logic to bypass authentication checks and allow the attacker to access proxied traffic without valid credentials.