GitHub Advisoryadvisory · PyPI

GHSA-527g-3w9m-29hv mitmproxy has an LDAP Injection

MEDIUM Published 2026-04-14 Modified 2026-06-06 Official page ↗
Aliases
CVE-2026-40606
Ecosystem
PyPI
Packages
mitmproxy
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-90
Reviewed
2026-04-14

Affected packages

• PyPI mitmproxy: < 12.2.2 → fixed in 12.2.2

Description

Impact In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication. Only mitmproxy instances using the `proxyauth` option with LDAP are affected. This option is not enabled by default. Patches The vulnerability has been fixed in mitmproxy 12.2.2 and above. Acknowledgements We thank Yue (Knox) Liu (@yueyueL) for responsibly disclosing this vulnerability to the mitmproxy team. Timeline • 2025-12-08: Received initial report. • 2025-12-09: Verified report and confirmed receipt. • 2026-01-02: Informed researcher that patch will be part of the next regular patch release. • 2026-04-12: Published patch release and advisory.

Related

Alias · CVE (1)

  • CVE-2026-40606 mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based… vulnerability

Weakness · CWE (1)

  • CWE-90 Improper Neutralization of Special Elements used in an LDAP Query weakness

References