High severity8.2NVD Advisory· Published Jun 17, 2026· Updated Jul 14, 2026

CVE-2026-55202

Description

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Tinyproxy/Tinyproxyllm-fuzzy
Range: <=1.11.3
osv-coords
pkg:rpm/opensuse/tinyproxy&distro=openSUSE%20Tumbleweed
Range: < 1.11.3-3.1

Patches

Vulnerability mechanics

References

github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bcenvd
github.com/tinyproxy/tinyproxy/pull/606nvd
www.vulncheck.com/advisories/evil-winrm-path-traversal-in-download-dir-functionnvd

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000