CVE-2026-40606: 
Python vulnerability analysis and mitigation

CVE-2026-40606 is an LDAP Injection vulnerability in mitmproxy's built-in LDAP proxy authentication that allows a malicious client to bypass authentication by crafting a specially formed username. It affects mitmproxy versions 12.2.1 and below; only instances configured with the proxyauth option using LDAP are impacted, and this option is not enabled by default. The vulnerability was initially reported on 2025-12-08, verified on 2025-12-09, and publicly disclosed with a patch on 2026-04-12. It carries a CVSS v3.1 base score of 4.8 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of special elements used in LDAP queries (CWE-90 / LDAP Injection, CAPEC-136). When mitmproxy's built-in proxy authentication is configured to use LDAP, the username supplied by a connecting client is incorporated into an LDAP query without adequate sanitization. An attacker can inject LDAP special characters (e.g., *, (, ), \, NUL) into the username field to manipulate the query logic and cause the LDAP server to return a successful authentication result for an otherwise unauthorized user. Exploitation requires that the target mitmproxy instance has the proxyauth option explicitly configured with an LDAP backend, which is a non-default configuration (GitHub Advisory).

Successful exploitation allows an unauthenticated or unauthorized client to bypass LDAP-based proxy authentication on affected mitmproxy instances, gaining unauthorized access to the proxy and any traffic routed through it. This can expose proxied HTTP/TLS traffic to interception or manipulation, undermine security controls that rely on LDAP authentication, and potentially allow attackers to use the proxy as a pivot point. Confidentiality and integrity impacts are rated Low; there is no availability impact (GitHub Advisory, Red Hat CVE).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The vulnerability has an EPSS score of approximately 0.035%, reflecting low near-term exploitation probability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement that the target must have LDAP-based proxyauth explicitly configured, raising the effective attack complexity (GitHub Advisory, Feedly).

1. Reconnaissance: Identify mitmproxy instances exposed on the network (e.g., via port scanning for common proxy ports such as 8080 or 8443) and confirm they require proxy authentication, indicating a proxyauth configuration.
2. Probe authentication type: Attempt a proxy connection and observe the authentication challenge; LDAP-backed instances will respond with a Proxy-Authenticate header requiring credentials.
3. Craft malicious username: Construct a username containing LDAP special characters designed to manipulate the LDAP filter logic — for example, using a wildcard or filter-breaking sequence such as *)(uid=*))(|(uid=* to cause the LDAP query to match any user.
4. Send crafted credentials: Submit the malicious username (with any password) as proxy credentials in the Proxy-Authorization header of an HTTP CONNECT or standard proxy request.
5. Bypass authentication: If the injected LDAP query evaluates to true on the server, mitmproxy grants proxy access without valid credentials, allowing the attacker to route traffic through the proxy (GitHub Advisory).

• Network: Proxy authentication requests (HTTP CONNECT or standard proxy requests) containing usernames with LDAP special characters such as *, (, ), \, or null bytes in the Proxy-Authorization header.
• Logs: mitmproxy access logs showing successful proxy authentications from unexpected source IPs or with usernames containing special characters; authentication successes that do not correspond to known LDAP user accounts.
• Logs: LDAP server query logs showing malformed or unexpected filter expressions originating from the mitmproxy host, particularly filters with wildcard or injected logic operators.
• Process/Behavior: Unusual or unauthorized traffic being routed through the mitmproxy instance from clients that should not have proxy access.

Upgrade mitmproxy to version 12.2.2 or later, which contains the fix for this vulnerability (GitHub Advisory). If immediate patching is not feasible, disable the proxyauth LDAP option until the upgrade can be completed, or restrict network access to the proxy port to trusted clients only. Review mitmproxy access logs for suspicious authentication attempts that may indicate exploitation. Note that instances not using the proxyauth option with LDAP are not affected.

The vulnerability was responsibly disclosed by researcher Yue (Knox) Liu (@yueyueL) to the mitmproxy team, who coordinated a patch release approximately four months after the initial report. The mitmproxy maintainer (mhils) published the advisory alongside the 12.2.2 patch release on 2026-04-12. No significant broader media coverage or notable community controversy has been observed, consistent with the moderate severity rating and non-default affected configuration (GitHub Advisory).