Is CVE-2026-55202 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55202 being exploited in the wild.

How severe is CVE-2026-55202?

High severity, with a CVSS score of 8.2, published 17 June 2026.

Is there a fix for CVE-2026-55202?

A patch was published on 2026-04-17: Fix merged in commit 09312a1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55202 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-55202?

Check whether you run Tinyproxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55202: Tinyproxy authentication bypass in stathost detection

CVE-2026-55202 · Severity: high · CVSS 8.2 · Published 2026-06-17

Tinyproxy is a lightweight web proxy used to manage and route internet traffic. A security flaw allows unauthorized users to access the proxy's internal statistics page or bypass security rules by manipulating web request headers. This could lead to the exposure of sensitive operational data or allow attackers to misroute traffic to unauthorized internal systems.

Technologies: Tinyproxy. Vendors: Tinyproxy.

Quick answers

Is CVE-2026-55202 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55202 being exploited in the wild.
How severe is CVE-2026-55202?: High severity, with a CVSS score of 8.2, published 17 June 2026.
Which products and versions are affected?: Tinyproxy through 1.11.3.
Is there a fix for CVE-2026-55202?: A patch was published on 2026-04-17: Fix merged in commit 09312a1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55202 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55202?: Check whether you run Tinyproxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Tinyproxy through 1.11.3 is vulnerable to an authentication bypass and security control circumvention due to improper validation of the HTTP Host header during 'stathost' detection. The vulnerability exists because the proxy fails to check the Host header before processing transparent proxy requests, and lacks rigorous validation of the hostname and port. An unauthenticated remote attacker can exploit this by injecting a matching Host header or using port manipulation to gain access to the internal statistics page. Furthermore, this flaw can be used to misroute requests as transparent proxy connections, potentially bypassing intended access control lists (ACLs). The issue is addressed in commit 09312a1.

Affected products

tinyproxy Tinyproxy through 1.11.3

Timeline

2026-04-17: patched: Fix merged in commit 09312a1
2026-06-17: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.