Tinyproxy through 1.11.3

CVE-2026-55202 affects Tinyproxy through version 1.11.3, a lightweight HTTP/HTTPS forward proxy popular in containers, IoT devices, and small-network deployments. The flaw is in stathost detection: Tinyproxy compares incoming Host headers against a configured stathost value (default tinyproxy.stats) to decide whether to serve an internal statistics page. The comparison logic fails to normalize the header, so an unauthenticated remote attacker can craft a Host header that passes the check and access the stats page — or cause routing confusion between stathost and transparent-proxy code paths. The fix landed in commit 09312a1 (PR #606). Affected: all versions 0 through 1.11.3. No formal release beyond 1.11.3 yet; you need the commit or a distro backport.

The vendor scored this 8.2 HIGH with C:H/I:L/A:N, but that Confidentiality:High rating is hard to justify. The stathost page exposes connection counts, open-connection numbers, and error tallies — basic operational telemetry, not credentials, tokens, or business data. Calling that C:H is CVSS theater. A more honest vector would use C:L, landing around 6.5 before friction adjustments. The routing-confusion angle (transparent-proxy misclassification) is acknowledged in the PR but is not demonstrated as a reliable ACL bypass in any public write-up. With the actual impact scoped to low-value metrics disclosure, this is a MEDIUM at most.

Why this verdict

• Confidentiality impact is overstated. The stathost page discloses connection counts, open connections, and error tallies — not credentials, session tokens, or sensitive business data. C:H is inaccurate; C:L is the correct rating, which alone drops the CVSS base from 8.2 to ~6.5.
• No demonstrated ACL bypass chain. The routing-confusion angle (transparent-proxy misclassification) is mentioned in the PR but no researcher or public PoC has demonstrated a reliable access-control bypass. The I:L rating may itself be generous.
• EPSS confirms low real-world attractiveness. At 0.00381, this sits in the bottom quartile of all scored CVEs. Attackers have better things to do than harvest proxy connection counts.
• Role multiplier: Tinyproxy is a lightweight forward proxy used in containers, IoT, and small-network edge deployments. It is not an identity provider, hypervisor, backup server, domain controller, or any other high-value-role component. Even in its most critical deployment (forward proxy for a network segment), the stathost page does not provide fleet-scale, identity-scale, or supply-chain-scale blast radius. The worst plausible outcome is low-value info disclosure on a single proxy instance. No high-value role floor applies.

Why not higher?

To warrant HIGH, the vulnerability would need to disclose genuinely sensitive data (credentials, tokens, PII) or provide a reliable path to ACL bypass enabling unauthorized proxy use or request smuggling. Neither is demonstrated. The stats page contains only operational counters, and the routing-confusion vector remains theoretical with no public exploit chain.

Why not lower?

The bug is unauthenticated and remotely exploitable with zero complexity against ~90K internet-facing instances. Even though the disclosed data is low-value, the attack surface is real and the fix requires a source-level commit with no formal release. Dropping below MEDIUM would undercount the exposure population and the ease of exploitation.

1. Disable the stathost feature — Comment out or remove the StatHost and StatFile directives in tinyproxy.conf and restart the service. This eliminates the attack surface entirely. No mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window.
2. Restrict proxy port access via firewall rules — Ensure Tinyproxy's listening port (default 8888) is not exposed to untrusted networks. Use iptables/nftables or security groups to limit inbound access to authorized clients only.
3. Set a non-default StatHost value — If you need stats, change StatHost to a long, random hostname (e.g., stats-a8f3e2b1c4d7.internal). This makes blind spoofing infeasible without knowledge of the configured value.
4. Apply the upstream commit — Cherry-pick commit 09312a1 from the tinyproxy repository, or wait for a distro backport. This is the definitive fix within the 365-day noisgate remediation SLA.

Run this on each host running Tinyproxy. Requires read access to the tinyproxy binary or package metadata, and optionally curl to probe the stats endpoint. Example: bash check_cve_2026_55202.sh

#!/usr/bin/env bash
# CVE-2026-55202 checker for Tinyproxy stathost Host header bypass
# Run on the host running tinyproxy. No elevated privileges needed for version check.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

PATCHED_COMMIT="09312a1"
VULN_MAX_VER="1.11.3"

# Try to get version from tinyproxy binary
if command -v tinyproxy &>/dev/null; then
  VER=$(tinyproxy -v 2>&1 | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
elif command -v dpkg &>/dev/null; then
  VER=$(dpkg -l tinyproxy 2>/dev/null | awk '/^ii/{print $3}' | grep -oP '[0-9]+\.[0-9]+\.[0-9]+')
elif command -v rpm &>/dev/null; then
  VER=$(rpm -q tinyproxy --qf '%{VERSION}' 2>/dev/null)
else
  echo "UNKNOWN - tinyproxy not found on this host"
  exit 2
fi

if [ -z "$VER" ]; then
  echo "UNKNOWN - could not determine tinyproxy version"
  exit 2
fi

# Compare versions
version_lte() {
  [ "$1" = "$(printf '%s\n%s' "$1" "$2" | sort -V | head -1)" ]
}

if version_lte "$VER" "$VULN_MAX_VER"; then
  # Check if distro backported the fix
  if command -v dpkg &>/dev/null; then
    FULL_PKG_VER=$(dpkg -l tinyproxy 2>/dev/null | awk '/^ii/{print $3}')
    if echo "$FULL_PKG_VER" | grep -qiE '(cve.2026.55202|09312a1)'; then
      echo "PATCHED - tinyproxy $VER (backport detected in $FULL_PKG_VER)"
      exit 0
    fi
  fi
  echo "VULNERABLE - tinyproxy $VER (<= $VULN_MAX_VER, fix is commit $PATCHED_COMMIT)"
  exit 1
else
  echo "PATCHED - tinyproxy $VER (> $VULN_MAX_VER)"
  exit 0
fi

Sources

1. NVD — CVE-2026-55202
2. GitHub PR #606 — Stathost detection fix
3. GitHub commit 09312a1
4. Censys — Tinyproxy exposure data (CVE-2023-49606)
5. Vulnerability-Lookup — CVE-2026-55202
6. tinyproxy.conf man page — StatHost documentation
7. BleepingComputer — Tinyproxy exposure context