Which versions of Tinyproxy are affected by CVE-2026-55202?

Tinyproxy versions through 1.11.3 contain a critical authentication bypass (CVE-2026-55202, CVSS 8.8) allowing unauthenticated remote attackers to access internal statistics pages and perform HTTP…. A patch is available.

How to fix or mitigate CVE-2026-55202?

Within 24 hours: Identify all Tinyproxy 1.11.3 and earlier installations and restrict network access to internal users only if patches cannot be immediately deployed. Within 7 days: Patch available per vendor advisory-apply the patched version to all affected instances. Within 30 days: Verify patches deployed across the entire infrastructure and retest to confirm Host header-based authentication bypass is no longer possible.

Tinyproxy CVE-2026-55202

Q: What is the CVSS score of CVE-2026-55202?

CVE-2026-55202 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-06-17 VulnCheck

Authentication Bypass Request Smuggling Tinyproxy

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Remote, no auth, single crafted request (AV:N/AC:L/PR:N/UI:N); stats disclosure gives C:H, transparent-proxy misrouting gives limited I:L, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 18, 2026 - 03:46 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 18, 2026 - 03:46 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 18, 2026 - 03:38 vuln.today

cvss_changed

Severity Changed

Jun 18, 2026 - 03:38 NVD

CRITICAL HIGH

CVSS changed

Jun 18, 2026 - 03:38 NVD

9.3 (CRITICAL) 8.8 (HIGH)

Source Code Evidence Fetched

Jun 17, 2026 - 20:03 vuln.today

Analysis Generated

Jun 17, 2026 - 20:03 vuln.today

DescriptionCVE.org

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

AnalysisAI

Authentication bypass in Tinyproxy through 1.11.3 lets unauthenticated remote attackers reach the internal statistics page and smuggle transparent-proxy requests by forging or port-manipulating the HTTP Host header, because stathost detection used a brittle strcmp against the configured hostname. The flaw is a CWE-444 request-interpretation inconsistency reported by VulnCheck; no public exploit identified at time of analysis, though the upstream fix (commit 09312a1) and a detailed PR diff are publicly available, making a working PoC trivial to reconstruct.

Technical ContextAI

Tinyproxy is a small, widely-deployed lightweight HTTP/HTTPS proxy daemon often embedded in routers, containers, and IoT gateways (CPE cpe:2.3:a:tinyproxy:tinyproxy:*). The 'stathost' is an internal pseudo-host that, when matched, causes the daemon to serve administrative connection statistics instead of proxying the request. Pre-patch code in src/reqs.c performed exact equality with strcmp(config->stathost, request->host), which ignored the Host: request header path and did not normalize a trailing ':port' suffix. The PR diff replaces this with an is_stathost() helper that compares the configured stathost prefix and explicitly accepts either end-of-string or a ':' delimiter, and is now invoked against both the URL host and the Host header. The class is CWE-444 (Inconsistent Interpretation of HTTP Requests / request smuggling): differing parsers between the absolute-URI host and the Host header allowed the security decision and the routing decision to disagree.

RemediationAI

Upstream fix available as commit 09312a1 (PR #606); a released, tagged patched version is not independently confirmed in the supplied data, so rebuild from current main or apply the src/reqs.c patch introducing is_stathost() and its two call sites. Track distribution package updates (Debian, Alpine, OpenWrt typically ship Tinyproxy) and replace any tinyproxy <= 1.11.3 binary. As a workaround until patched, comment out or remove the StatHost directive in tinyproxy.conf, which eliminates the stathost code path entirely at the cost of losing the operational statistics endpoint; alternatively, restrict the listening interface with Listen/Allow to trusted management ranges and front the proxy with an L7 device that normalizes the Host header, accepting the side effect that legitimate clients sending Host headers with a :port suffix may be rejected. Advisory references: https://github.com/tinyproxy/tinyproxy/pull/606, https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce, https://vuldb.com/vuln/372109.