CVE-2026-55202

The record

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

Affected packages

Related vulnerabilities

• CVE-2026-54387 Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting… Also affects tinyproxy
• CVE-2026-54388 Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing… Also affects tinyproxy
• CVE-2026-3945 An integer overflow vulnerability in the HTTP chunked transfer encoding parser in… Also affects tinyproxy
• CVE-2017-11747 main.c in Tinyproxy 1.8.4 and earlier creates a /run/tinyproxy/tinyproxy.pid file after… Also affects tinyproxy
• CVE-2026-114640 Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its… CWE-290
• CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-290
• CVE-2026-66674 Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions. CWE-290
• CVE-2026-82563 An attacker could impersonate the camera and place themselves in a man-in-the-middle or… CWE-290