VulnSocial

CVE-2026-55202Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circumvent access controls.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-290

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-06-17: 2Patch / Workaround · 2026-06-17: 1Technical Details · 2026-06-17: 206-17
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets3 URLs
Full discourse2 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-55202 Unauthenticated Host Header Injection in Tinyproxy Through 1.11.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-55202 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    The alert announces CVE-2026-55202, a guest-host header injection flaw affecting Tinyproxy versions through 1.11.3, linking to vulnerability details but providing no patch or exploitation information.

    0000039
    4.0K followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-55202 Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access … https://www.cve.org/CVERecord?id=CVE-2026-55202

    Post summary

    Tinyproxy 1.11.3 hosts a Host header validation flaw that is mitigated in commit 09312a1; no PoC or active exploitation claimed.

    00000119
    57.6K followersView on X

Explore more

Back to dashboard