CVE-2026-40606: mitmproxy LDAP Authentication Bypass Vulnerability
Summary
CVE-2026-40606: mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. Affects mitmproxy versions < 12.2.2. Fixed in 12.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mitmproxy is an interactive, TLS-capable intercepting HTTP proxy designed for penetration testers and software developers. It allows users to inspect, modify, and replay web traffic. mitmweb serves as a web-based interface for mitmproxy, enhancing user experience by providing a graphical representation of the traffic. The package is widely used for debugging and testing web applications, but it has a critical vulnerability in its LDAP proxy authentication feature.
Vulnerability Detail
In mitmproxy versions 12.2.1 and below, the built-in LDAP proxy authentication does not properly sanitize the username when querying the LDAP server. This flaw allows a malicious client to bypass authentication, potentially leading to unauthorized access to sensitive data or functionalities. The vulnerability specifically affects instances of mitmproxy that utilize the proxyauth option with LDAP, which is not enabled by default. The CVSS score for this vulnerability is 4.8, indicating a medium severity level.
How To Fix
Latest published version: 12.3.0 as of 22 Oct 2026
pip install --upgrade "mitmproxy==12.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
12.2.2
This is the first release that contains the fix.
pip install --upgrade "mitmproxy==12.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update mitmproxy, consider disabling the proxyauth option if it is enabled. This will prevent the vulnerability from being exploited until you can apply the patch.
Conclusion
CVE-2026-40606 is a significant vulnerability in mitmproxy that allows for LDAP authentication bypass. Users are strongly advised to update to version 12.2.2 or above to protect against unauthorized access. Utilizing Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mitmproxy →
FAQ
The vulnerability allows unauthorized clients to bypass LDAP authentication, potentially leading to unauthorized access to sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
mitmproxy versions 12.2.1 and below are affected by this vulnerability.
No, the proxyauth option with LDAP is not enabled by default, so only instances where this option is explicitly enabled are at risk.
If an immediate update is not possible, disable the proxyauth option to mitigate the risk until you can upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for mitmproxy.
