CVE-2026-55202

EUVD-2026-37786
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.2 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 30%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
tinyproxy_projecttinyproxy
𝑥
≤ 1.11.3
CNA
Debian logo
Debian Releases
Debian Product
Codename
tinyproxy
bookworm
postponed
bookworm (security)
vulnerable
bullseye
1.10.0-5
fixed
bullseye (security)
1.10.0-5+deb11u1
fixed
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tinyproxy
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
trusty
needs-triage
Common Weakness Enumeration
References
https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce
https://github.com/tinyproxy/tinyproxy/pull/606
https://www.vulncheck.com/advisories/evil-winrm-path-traversal-in-download-dir-function