CVE-2026-40606: mitmproxy LDAP injection in LDAP proxy authentication

Executive brief

mitmproxy is an open-source tool used for intercepting and analyzing web traffic. A security flaw in its LDAP authentication module allows unauthorized users to bypass login requirements by providing specially crafted usernames. This could allow an attacker to use the proxy without permission, potentially masking their identity or accessing restricted network resources.

Technical details

An LDAP injection vulnerability (CWE-90) exists in mitmproxy versions 12.2.1 and below. The root cause is the improper neutralization of special characters in the username field when constructing LDAP queries for proxy authentication. A remote attacker can exploit this by providing a malicious username that alters the logic of the LDAP query, leading to an authentication bypass. This vulnerability only affects instances where the 'proxyauth' option is explicitly configured to use LDAP. The issue is resolved in version 12.2.2.

Affected products

• mitmproxy mitmproxy <= 12.2.1

Timeline

• 2025-12-08: disclosed: Initial report received from researcher
• 2026-04-12: patched: Patch and advisory published
• 2026-04-14: advisory: GitHub Advisory published

References

• https://api.github.com/users/yueyueL
• https://github.com/yueyueL
• https://api.github.com/users/yueyueL/gists%7B/gist_id%7D
• https://api.github.com/users/yueyueL/repos
• https://avatars.githubusercontent.com/u/64764840?v=4
• https://api.github.com/users/yueyueL/events%7B/privacy%7D