CVE-2026-125371 (CVSS 4.8)

Description

Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs.

Is your site exposed to CVE-2026-125371?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.8

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS — Exploit Prediction

0.0028

Probability of exploitation

0.21%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-187 CWE-187

References

Other References

https://github.com/tinyproxy/tinyproxy https://github.com/tinyproxy/tinyproxy/blob/1.11.3/src/acl.c#L156-L174 https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28 https://github.com/tinyproxy/tinyproxy/issues/627 https://www.vulncheck.com/advisories/tinyproxy-through-1.11.3-hostname-acl-allow-list-bypass-via-suffix-match

Frequently Asked Questions

What is CVE-2026-125371? +

Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs. It has a CVSS v3.1 base score of 4.8 (MEDIUM).

How severe is CVE-2026-125371? +

CVE-2026-125371 has a CVSS v3.1 score of 4.8 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0028, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-125371? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-41110 9.9

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions …

CVE-2026-115646 9.8

Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version …

CVE-2024-39742 8.1

IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due …

CVE-2026-94576 8.0

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d …

CVE-2026-87853 7.5

A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with …

CVE-2026-101914 6.5

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the …