What is GHSA-527g-3w9m-29hv?

GHSA-527g-3w9m-29hv is a security advisory published by GitHub Security Advisories with Medium severity. mitmproxy has an LDAP Injection

Which CVE IDs does GHSA-527g-3w9m-29hv cover?

GHSA-527g-3w9m-29hv covers the following CVE IDs: CVE-2026-40606. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-527g-3w9m-29hv?

GHSA-527g-3w9m-29hv has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

Which products are affected by GHSA-527g-3w9m-29hv?

GHSA-527g-3w9m-29hv affects 1 product, including: pip/mitmproxy:\u003c= 12.2.1.

GHSA-527g-3w9m-29hvMediumCVSS 4.8

mitmproxy has an LDAP Injection

Vendor

GitHub Security Advisories

Published

April 14, 2026

Last Modified

June 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-40606 →

📋 Description

Impact

In mitmproxy 12.2.1 and below, the builtin LDAP proxy authentication does not correctly sanitize the username when querying the LDAP server. This allows a malicious client to bypass authentication.

Only mitmproxy instances using the proxyauth option with LDAP are affected. This option is not enabled by default.

Patches

The vulnerability has been fixed in mitmproxy 12.2.2 and above.

Acknowledgements

We thank Yue (Knox) Liu (@yueyueL) for responsibly disclosing this vulnerability to the mitmproxy team.

Timeline

2025-12-08: Received initial report.
2025-12-09: Verified report and confirmed receipt.
2026-01-02: Informed researcher that patch will be part of the next regular patch release.
2026-04-12: Published patch release and advisory.

🎯 Affected products1

pip/mitmproxy:<= 12.2.1