What is CVE-2026-40606?

CVE-2026-40606 is a medium-severity vulnerability in Mitmproxy, classified under LDAP Injection. CVSS score: 4.8/10. Published 2026-04-21.

How severe is CVE-2026-40606?

Medium severity. CVSS v3 base score is 4.8 out of 10.

LDAP Injection in Mitmproxy

CVE-2026-40606

mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication. Only mitmproxy instances using the proxyauth option with LDAP are affected. This option is not enabled by default. The vulnerability has been fixed in mitmproxy 12.2.2 and above.

EPSS: 0.002 (6.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Mitmproxy — versions < 12.2.2

Weakness classification (CWE)

CWE-90 — LDAP Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2026-40606?: CVE-2026-40606 is a medium-severity vulnerability in Mitmproxy, classified under LDAP Injection. CVSS score: 4.8/10. Published 2026-04-21.
How severe is CVE-2026-40606?: Medium severity. CVSS v3 base score is 4.8 out of 10.