{"id":"CVE-2026-125371","kind":"vulnerability","aliases":["CVE-2026-125371"],"related":[],"title":"Tinyproxy: hostname ACL check lets attackers bypass proxy access control","description":"Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.","summary":"Tinyproxy compares only the trailing characters of a client's reverse DNS name against allowed hostnames, without checking label boundaries. An attacker who controls the PTR record for their IP can use a name like untrusted.net to match an allow rule for trusted.net and use the proxy.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","runtime","self-hosted","tinyproxy"],"not_affected_if":["deny-by-default-not-hostname","ip-only-acl"],"how_to_check":"- Run `tinyproxy -v` to read the installed version, and check whether it is `1.11.3` or earlier.\n- Look in `tinyproxy.conf` for `Allow` lines that use hostnames rather than IP addresses or CIDR ranges.\n- Confirm whether `Allow` entries with hostnames are present in your configuration.","fix":null,"status":"open","published_at":"2026-11-10T00:17:09+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","triaged_at":"2026-11-10T00:30:20+00:00","updated_at":"2026-11-10T00:30:20+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T00:30:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Tinyproxy: hostname ACL check lets attackers bypass proxy access control","impact":"medium","summary":"Tinyproxy compares only the trailing characters of a client's reverse DNS name against allowed hostnames, without checking label boundaries. An attacker who controls the PTR record for their IP can use a name like untrusted.net to match an allow rule for trusted.net and use the proxy.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["tinyproxy","self-hosted","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Unauthorized clients can use the proxy despite deny-by-default access rules.","analyst_note":"Confirm the fixed Tinyproxy version from the upstream patch on github.com and the vulncheck advisory; the sources here do not state it.","how_to_check":"- Run `tinyproxy -v` to read the installed version, and check whether it is `1.11.3` or earlier.\n- Look in `tinyproxy.conf` for `Allow` lines that use hostnames rather than IP addresses or CIDR ranges.\n- Confirm whether `Allow` entries with hostnames are present in your configuration.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["ip-only-acl","deny-by-default-not-hostname"],"who_is_affected":"Teams that run Tinyproxy with hostname-based Allow rules are exposed, because the flaw only matters when an access rule names a hostname. Deployments that allow access only by IP address or CIDR range are not affected by this flaw. The sources do not give the fixed version beyond the patch link, so check the upstream commit for the exact release.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000782,"input_tokens":4628,"output_tokens":638,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125371':13A,16A '-2026':12A,15A '1.11.3':72C 'access':9A,75C 'acl':3A,80C,123C 'allow':37B,62B,111C 'attack':6A,44B,96C 'boundari':42B,95C 'bypass':7A,77C 'charact':28B,90C 'check':4A,40B,92C 'client':31B 'compar':24B,86C 'contain':73C 'control':10A,46B,76C,97C 'cve':11A,14A 'default':122C 'deni':120C 'deny-by-default':119C 'despit':118C 'dns':34B,93C 'entri':113C 'host':21B 'hostnam':2A,38B,89C 'ip':52B,104C 'label':41B,94C 'let':5A 'like':57B 'linux':17B 'match':60B 'name':35B,56B 'process':82C 'proxi':8A,69B,117C 'ptr':48B,99C 'record':49B,100C 'revers':33B 'rule':63B 'runtim':18B 'satisfi':109C 'self':20B 'self-host':19B 'sourc':103C 'src/acl.c':84C 'string':81C 'tinyproxi':1A,22B,23B,70C 'trail':27B,88C 'trusted.net':65B,112C 'untrusted.net':58B,107C 'use':54B,67B,115C 'vulner':78C 'without':39B,91C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Tinyproxy with hostname-based Allow rules are exposed, because the flaw only matters when an access rule names a hostname. Deployments that allow access only by IP address or CIDR range are not affected by this flaw. The sources do not give the fixed version beyond the patch link, so check the upstream commit for the exact release.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linux","medium","runtime","selfhosted","tinyproxy"],"campaign_type":null,"search_a":"'-125371':13A,16A '-2026':12A,15A 'access':9A 'acl':3A 'attack':6A 'bypass':7A 'check':4A 'control':10A 'cve':11A,14A 'hostnam':2A 'let':5A 'proxi':8A 'tinyproxi':1A","search_b":"'allow':37B,62B 'attack':44B 'boundari':42B 'charact':28B 'check':40B 'client':31B 'compar':24B 'control':46B 'dns':34B 'host':21B 'hostnam':38B 'ip':52B 'label':41B 'like':57B 'linux':17B 'match':60B 'name':35B,56B 'proxi':69B 'ptr':48B 'record':49B 'revers':33B 'rule':63B 'runtim':18B 'self':20B 'self-host':19B 'tinyproxi':22B,23B 'trail':27B 'trusted.net':65B 'untrusted.net':58B 'use':54B,67B 'without':39B","search_c":"'1.11.3':72C 'access':75C 'acl':80C,123C 'allow':111C 'attack':96C 'boundari':95C 'bypass':77C 'charact':90C 'check':92C 'compar':86C 'contain':73C 'control':76C,97C 'default':122C 'deni':120C 'deny-by-default':119C 'despit':118C 'dns':93C 'entri':113C 'hostnam':89C 'ip':104C 'label':94C 'process':82C 'proxi':117C 'ptr':99C 'record':100C 'satisfi':109C 'sourc':103C 'src/acl.c':84C 'string':81C 'tinyproxi':70C 'trail':88C 'trusted.net':112C 'untrusted.net':107C 'use':115C 'vulner':78C 'without':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T00:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125371","severity":null,"published_at":"2026-11-10T00:17:09+00:00","modified_at":"2026-11-10T00:17:09+00:00","first_seen_at":"2026-11-10T00:28:42+00:00","fetched_at":"2026-11-10T00:28:42+00:00","note":null}],"documents":[{"id":111519,"url":"https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111520,"url":"https://www.vulncheck.com/advisories/tinyproxy-through-1.11.3-hostname-acl-allow-list-bypass-via-suffix-match","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}