LDAP injection in mitmproxy - CVE-2026-40606
Published: April 13, 2026
Vulnerability identifier: #VU125835
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40606
CWE-ID: CWE-90
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to improper neutralization of special elements used in an LDAP query in the builtin LDAP proxy authentication when querying the LDAP server with an unsanitized username. A remote attacker can supply a crafted username to bypass authentication.
Only mitmproxy instances using the proxyauth option with LDAP are vulnerable, and this option is not enabled by default.
Affected software
mitmproxy
How to mitigate CVE-2026-40606
Install security update from vendor's website.
mitmproxy - update to 12.2.2