Executive brief
Tinyproxy is a lightweight web proxy used to manage and route internet traffic. A security flaw allows unauthorized users to access the proxy's internal statistics page or bypass security rules by manipulating web request headers. This could lead to the exposure of sensitive operational data or allow attackers to misroute traffic to unauthorized internal systems.
Technical details
Tinyproxy through 1.11.3 is vulnerable to an authentication bypass and security control circumvention due to improper validation of the HTTP Host header during 'stathost' detection. The vulnerability exists because the proxy fails to check the Host header before processing transparent proxy requests, and lacks rigorous validation of the hostname and port. An unauthenticated remote attacker can exploit this by injecting a matching Host header or using port manipulation to gain access to the internal statistics page. Furthermore, this flaw can be used to misroute requests as transparent proxy connections, potentially bypassing intended access control lists (ACLs). The issue is addressed in commit 09312a1.
Affected products
- tinyproxy Tinyproxy through 1.11.3
Timeline
- 2026-04-17: patched: Fix merged in commit 09312a1
- 2026-06-17: disclosed: CVE published to NVD