CVE-2026-40606: ProxyAuth Addon LDAP Injection in mitmproxy
Impact In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication.
Only mitmproxy instances using the proxyauth option with LDAP are affected. This option is not enabled by default.
Patches
The vulnerability has been fixed in mitmproxy 12.2.2 and above.
Acknowledgements
We thank Yue (Knox) Liu (@yueyueL) for responsibly disclosing this vulnerability to the mitmproxy team.
Timeline
- 2025-12-08: Received initial report. - 2025-12-09: Verified report and confirmed receipt. - 2026-01-02: Informed researcher that patch will be part of the next regular patch release. - 2026-04-12: Published patch release and advisory.
Other sources
mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication. Only mitmproxy instances using the proxyauth option with LDAP are affected. This option is not enabled by default. The vulnerability has been fixed in mitmproxy 12.2.2 and above.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40606?
The severity of CVE-2026-40606 is medium with a score of 4.8.
How do I fix CVE-2026-40606?
To fix CVE-2026-40606, upgrade to a version of mitmproxy above 12.2.1 that has addressed this LDAP injection vulnerability.
What impact does CVE-2026-40606 have on mitmproxy?
CVE-2026-40606 allows a malicious client to bypass authentication due to improper sanitization of usernames in LDAP proxy authentication.
Which versions of mitmproxy are affected by CVE-2026-40606?
Mitmproxy versions 12.2.1 and below are affected by CVE-2026-40606.
What configuration option exposes mitmproxy to CVE-2026-40606?
The 'proxyauth' option with LDAP authentication exposes mitmproxy to CVE-2026-40606.