CVE-2026-55202: Tinyproxy - Stathost Detection Bypass via Host Header Manipulation
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tinyproxyto a version that resolves this vulnerability.Fixed in 1.11.3Patch 09312a1 - Compensating control
Restrict access to the tinyproxy stats/stathost endpoint (e.g., via network ACL/firewall) so unauthenticated clients cannot reach it even if Host-header validation is bypassed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55202?
The severity of CVE-2026-55202 is rated as critical with a score of 9.1.
How do I fix CVE-2026-55202?
To fix CVE-2026-55202, update Tinyproxy to version 1.11.4 or later, which includes the necessary validation for the Host header.
What can an attacker do with CVE-2026-55202?
An attacker can exploit CVE-2026-55202 to bypass stathost detection and gain unauthorized access to the Tinyproxy stats page.
Which versions of Tinyproxy are affected by CVE-2026-55202?
Tinyproxy versions prior to 1.11.4 are affected by CVE-2026-55202.
What type of attack does CVE-2026-55202 involve?
CVE-2026-55202 involves a Host header manipulation attack that allows unauthenticated access to sensitive information.