CVE-2026-55202: Tinyproxy - Stathost Detection Bypass via Host Header Manipulation

Synopsis

An authentication bypass vulnerability in Tinyproxy (versions through 1.11.3) allows unauthenticated remote attackers to access the proxy's internal stats page by manipulating the Host header during stathost detection. The flaw is reachable over the network with no credentials required and no victim interaction needed. Successful exploitation exposes internal proxy statistics and allows request misrouting that circumvents access controls. A patched-image rebuild at the fixed commit (09312a185ae25cc486b4ff5987638a7917a48bce) is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Tinyproxy service over the network; no local access or physical proximity is required.

• AuthenticationNot required

  No credentials are needed; the bypass is available to any unauthenticated caller who can send an HTTP request to the proxy.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; crafting a manipulated Host header requires no race condition, memory-layout knowledge, or environmental prerequisite.

Blast Radius

• Reads internal proxy statistics (connection counts, request logs, and configuration details) from the stathost page without authorization.
• Misroutes HTTP requests by bypassing stathost detection, causing requests that should be blocked or handled as admin traffic to be forwarded as transparent proxy connections.
• Allows an attacker to probe internal network topology or backend services by abusing the misrouted request path.