CVE-2026-55202: Tinyproxy Host Header Validation Bypass – Statistics Page Access & Request Misrouting

Technical summary

CVE-2026-55202 is an improper input validation vulnerability (CWE-290) in Tinyproxy's stathost detection mechanism. The vulnerability stems from insufficient validation of the Host header when determining whether an incoming request should be routed to the internal statistics page. An unauthenticated, network-adjacent attacker can inject a Host header matching the stathost configuration or manipulate the port value to bypass the detection logic. This allows unauthorized access to the stats endpoint or causes the proxy to misinterpret transparent proxy connection attempts, resulting in request misrouting. The vulnerability was fixed in commit 09312a1 of the Tinyproxy repository.

Business impact

Organizations running Tinyproxy as an HTTP proxy can face unauthorized disclosure of internal proxy statistics, which may reveal operational metrics, request patterns, and configuration details valuable to attackers. Additionally, the ability to misroute requests through port manipulation could allow attackers to bypass network segmentation or access control policies that rely on the proxy's transparent mode functionality. This is particularly concerning in environments where the proxy is deployed as a network gateway or security boundary.

Affected systems

Tinyproxy versions through 1.11.3 are affected. The vulnerability requires network access to the proxy but does not require authentication. Deployments where Tinyproxy is exposed to untrusted networks or where the statistics page is not behind additional network-level access controls are at highest risk.

Exploitability

The vulnerability is highly exploitable. It requires only network connectivity to the proxy and no authentication. An attacker can craft a simple HTTP request with a malicious Host header or manipulate the port field—both standard HTTP protocol features—to trigger the bypass. No special tools, credentials, or user interaction are needed. The attack surface is broad because the flaw exists in fundamental request handling logic that processes every incoming connection.

Remediation

Update Tinyproxy to a patched version that includes the fix from commit 09312a1 or later. Verify against the official Tinyproxy releases and security advisories for the specific patched version number applicable to your deployment. Until patching is complete, restrict network access to the Tinyproxy proxy to trusted clients only. If the statistics page functionality is not needed, consider disabling or blocking access to the stathost endpoint at the firewall or network layer.

Patch guidance

Check the official Tinyproxy project repository and releases for versions released after the fix commit 09312a1. Apply the patched version to all Tinyproxy instances in your environment. Test the patch in a staging environment to ensure compatibility with your proxy configuration and dependent applications. Consider coordinating the upgrade during a maintenance window to minimize service disruption. Verify that traffic patterns and proxy statistics collection continue to function correctly post-upgrade.

Detection guidance

Monitor HTTP access logs for requests to your Tinyproxy statistics endpoint with suspicious or unexpected Host header values. Look for requests containing modified port numbers in the Host header that do not match your actual proxy configuration. Implement network-based detection rules to flag requests attempting to access the stats page from sources outside your trusted network. If available, enable verbose logging on Tinyproxy to capture Host header validation events. Check for any baseline changes in statistics page access patterns or unusual spike in statistics-related requests.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.2), high impact on confidentiality, and trivial exploitability. The attack requires no authentication, no user interaction, and minimal network sophistication. An exposed Tinyproxy instance is vulnerable to reconnaissance and access control bypass with a single crafted HTTP request. Organizations should prioritize patching, especially if the proxy is internet-facing or accessible from untrusted networks.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) reflects a network-adjacent attack vector with low complexity, no privileges required, and no user interaction needed. The vulnerability has high impact on confidentiality (stats disclosure) and low impact on integrity (request misrouting). Availability is not affected. The score appropriately weighs the ease of exploitation against the real but limited scope of impact; this is not a full system compromise but a meaningful security boundary violation.

Frequently asked questions