CVE-2025-23217: mitmproxy API Authentication Bypass Vulnerability
Summary
CVE-2025-23217: Mitmweb API Authentication Bypass Using Proxy Server. Affects mitmproxy versions < 11.1.2. Fixed in 11.1.2. How to fix ↓
Also tracked for
- mitmproxy · Debian:11
The same CVE-2025-23217 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mitmproxy is an open-source interactive HTTPS proxy that allows developers to inspect, modify, and replay web traffic. It is widely used for debugging and testing web applications. The tool provides a user-friendly interface through mitmweb, which allows users to visualize and interact with the traffic. However, a security flaw has been identified in mitmweb that exposes its internal API to unauthorized access through its proxy server.
Vulnerability Detail
In mitmweb versions 11.1.0 and below, a malicious client can exploit the proxy server, which is bound to '*:8080', to gain access to the internal API located at '127.0.0.1:8081'. Although direct access to the API is restricted, the proxy allows this unauthorized access, potentially leading to SSRF-style attacks and remote code execution. This vulnerability requires the attacker to be on the same local network, as the 'block_global' option, which is enabled by default, prevents connections from publicly-routable IP addresses.
How To Fix
Latest published version: 12.3.0 as of 22 Oct 2026
pip install --upgrade "mitmproxy==12.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.1.2
This is the first release that contains the fix.
pip install --upgrade "mitmproxy==11.1.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the proxy server by configuring firewall rules to block incoming connections from unauthorized IP addresses, ensuring that only trusted clients can connect to the proxy.
Conclusion
The CVE-2025-23217 vulnerability in mitmproxy's mitmweb component poses a significant risk by allowing unauthorized access to its internal API through the proxy server. Users are strongly advised to update to version 11.1.2 or above to mitigate this risk. Implementing additional security measures, such as firewall rules, can provide further protection until the update is applied.
See every vulnerability recorded for mitmproxy →
FAQ
The vulnerability allows unauthorized access to the internal API of mitmweb, which could lead to SSRF attacks and potentially remote code execution.
Users of mitmweb versions 11.1.0 and below are affected, particularly those who have the proxy server exposed to local networks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update, consider implementing strict firewall rules to limit access to the proxy server and monitor your network for any suspicious activity.
No, only mitmweb is affected by this vulnerability. The command-line tools mitmproxy and mitmdump are not impacted.
References
Related vulnerabilities
Recent vulnerabilities recorded for mitmproxy.
