How severe is CVE-2026-40606?

CVE-2026-40606 has a CVSS 3.x base score of 4.8, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-40606 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-40606?

CVE-2026-40606 affects Mitmproxy. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-40606?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-40606 have an EU (EUVD) identifier?

Yes. CVE-2026-40606 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-24215.

When was CVE-2026-40606 published?

CVE-2026-40606 was published on 2026-04-21 and last updated on 2026-06-17.

CVE-2026-40606

CVE-2026-40606 is a medium-severity vulnerability in Mitmproxy with a CVSS 3.x base score of 4.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-90.

Key facts

Severity: Medium (CVSS 3.x base score 4.8)
EPSS exploit prediction: 0% (6th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-24215
Weakness: CWE-90
Affected product: Mitmproxy
Published: 2026-04-21
Last modified: 2026-06-17

Description

mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication. Only mitmproxy instances using the proxyauth option with LDAP are affected. This option is not enabled by default. The vulnerability has been fixed in mitmproxy 12.2.2 and above.

Frequently asked questions

What is CVE-2026-40606?: mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication. Only mitmproxy instances using the proxyauth option with LDAP are affected. This option is not enabled by default. The vulnerability has been fixed in mitmproxy 12.2.2 and above.
How severe is CVE-2026-40606?: CVE-2026-40606 has a CVSS 3.x base score of 4.8, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-40606 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-40606?: CVE-2026-40606 affects Mitmproxy. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-40606?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-40606 have an EU (EUVD) identifier?: Yes. CVE-2026-40606 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-24215.
When was CVE-2026-40606 published?: CVE-2026-40606 was published on 2026-04-21 and last updated on 2026-06-17.

References

https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-527g-3w9m-29hv

Affected products (1)

cpe:2.3:a:mitmproxy:mitmproxy:*:*:*:*:*:*:*:*

More vulnerabilities in Mitmproxy

CVE-2022-24766 — Critical (CVSS 9.8): mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or…
CVE-2018-14505 — High (CVSS 8.8): mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py.
CVE-2021-39214 — High (CVSS 8.1): mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious client or…

All CVEs affecting Mitmproxy →

Other CWE-90 (LDAP Injection) vulnerabilities

CVE-2026-44930 — Critical (CVSS 9.8): An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an…
CVE-2026-25560 — Critical (CVSS 9.8): WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied…
CVE-2024-54852 — Critical (CVSS 9.8): When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is…
CVE-2024-33868 — Critical (CVSS 9.8): An issue was discovered in linqi before 1.4.0.1 on Windows. There is LDAP injection.
CVE-2011-4069 — Critical (CVSS 9.8): html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and…
CVE-2017-14596 — Critical (CVSS 9.8): In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username…

Browse all CWE-90 (LDAP Injection) vulnerabilities →