p PatchFirst

CVE-2026-40606

CVE-2026-40606 · ProxyAuth Addon LDAP Injection in mitmproxy

This page contains facts from public vulnerability sources. Check the original advisory before updating.

mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication. Only mitmproxy instances using the proxyauth option with LDAP are affected. This option is not enabled by default. The vulnerability has been fixed in mitmproxy 12.2.2 and above.

CVSS 4.8 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • mitmproxy

    Versions
    • < 12.2.2: Affected

    No fix published

  • mitmproxy Debian:12

    Versions
    • 8.1.1-2
    • 8.1.1-3
    • 8.1.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mitmproxy Debian:14

    Versions
    • 0.10-1
    • 0.10-2
    • 0.10.1-1
    • 0.10.1-2
    • 0.11.3-1
    • 0.11.3-2
    • 0.11.3-3
    • 0.12.1-1
    • 0.12.1-2
    • 0.13-1
    • 0.15-1
    • 0.15-2
    • 0.18.1-1
    • 0.18.1-2
    • 0.18.2-1
    • 0.18.2-2
    • 0.18.2-3
    • 0.18.2-4
    • 0.18.2-5
    • 0.18.2-6
    • 0.6-1
    • 0.6-2
    • 0.6-3
    • 0.7-1
    • 0.8-1
    • 0.8-2
    • 0.9.1-1
    • 0.9.1-2
    • 0.9.2-1
    • 0.9.2-2
    • 2.0.2-1
    • 2.0.2-2
    • 2.0.2-3
    • 2.0.2-4
    • 3.0.3-1
    • 3.0.4-1
    • 4.0.4-1
    • 4.0.4-2
    • 4.0.4-3
    • 4.0.4-4
    • 4.0.4-5
    • 4.0.4-6
    • 4.0.4-6.1
    • 5.1.1-1
    • 5.1.1-2
    • 5.3.0-1
    • 5.3.0-2
    • 5.3.0-3
    • 6.0.2-1
    • 6.0.2-2
    • 8.1.1-1
    • 8.1.1-2
    • 8.1.1-3
    • 8.1.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mitmproxy PyPI

    Versions
    • 0.10
    • 0.10.1
    • 0.11
    • 0.11.1
    • 0.11.2
    • 0.11.3
    • 0.12.0
    • 0.12.1
    • 0.13
    • 0.14.0
    • 0.15
    • 0.16
    • 0.17
    • 0.18.1
    • 0.18.2
    • 0.18.3
    • 0.8
    • 0.8.1
    • 0.9
    • 0.9.1
    • 0.9.2
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 10.0.0
    • 10.1.0
    • 10.1.1
    • 10.1.2
    • 10.1.3
    • 10.1.4
    • 10.1.5
    • 10.1.6
    • 10.2.0
    • 10.2.1
    • 10.2.2
    • 10.2.3
    • 10.2.4
    • 10.3.0
    • 10.3.1
    • 10.4.0
    • 10.4.1
    • 10.4.2
    • 11.0.0
    • 11.0.1
    • 11.0.2
    • 11.1.0
    • 11.1.2
    • 11.1.3
    • 12.0.0
    • 12.0.1
    • 12.1.0
    • 12.1.1
    • 12.1.2
    • 12.2.0
    • 12.2.1
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 4.0.0
    • 4.0.1
    • 4.0.3
    • 4.0.4
    • 5.0.0
    • 5.0.1
    • 5.1.0
    • 5.1.1
    • 5.2
    • 5.3.0
    • 6.0.0
    • 6.0.1
    • 6.0.2
    • 7.0.0
    • 7.0.1
    • 7.0.2
    • 7.0.3
    • 7.0.4
    • 8.0.0
    • 8.1.0
    • 8.1.1
    • 9.0.0
    • 9.0.1
    Affected ranges
    • ECOSYSTEM: < 12.2.2

    Update to 12.2.2

  • mitmproxy Ubuntu:16.04:LTS

    Versions
    • 0.11.3-3
    • 0.12.1-2
    • 0.13-1
    • 0.15-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mitmproxy Ubuntu:18.04:LTS

    Versions
    • 2.0.2-2
    • 2.0.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mitmproxy Ubuntu:20.04:LTS

    Versions
    • 4.0.4-6
    • 4.0.4-6.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mitmproxy Ubuntu:22.04:LTS

    Versions
    • 6.0.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mitmproxy Ubuntu:24.04:LTS

    Versions
    • 8.1.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mitmproxy Ubuntu:25.10

    Versions
    • 8.1.1-2
    • 8.1.1-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mitmproxy Ubuntu:26.10

    Versions
    • 8.1.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mitmproxy Ubuntu:26.04:LTS

    Versions
    • 8.1.1-3
    • 8.1.1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →