Loading story…
A critical vulnerability in ProxySQL, tracked as CVE-2026-48772, allows remote attackers to spoof client source IP addresses by abusing improper parsing of HAProxy PROXY protocol v1 UNKNOWN headers. A crafted frame with appended address fields can cause ProxySQL to trust a forged IP and use it in mysql_query_rules.client_addr, stats_mysql_processlist.cli_host, and event_log, enabling access-control and routing bypass as well as misleading audit trails. The issue affects ProxySQL versions 2.0.0 through 3.0.8 and is especially dangerous because mysql-proxy_protocol_networks = '*' is the default, exposing any reachable MySQL frontend to attempted exploitation.
The flaw was reproduced in testing by sending a forged address that triggered query rules intended for a different client, demonstrating the ability to influence schema pinning, query filtering, and other IP-based controls. ProxySQL addressed the issue in version 3.0.9, which also fixed another critical pre-authentication memory-corruption bug, CVE-2026-48773. Security advisories rate CVE-2026-48772 as remotely exploitable and severe, with published scores ranging from CVSS 9.1 to 10.0, and urge organizations running 3.0.8 or earlier to upgrade immediately.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A CVE entry documented CVE-2026-48773 as a critical pre-authentication heap memory corruption flaw in ProxySQL versions 2.0.18 through 3.0.8. It said oversized initial MySQL or PostgreSQL packets can trigger a remote heap overflow before authentication and identified ProxySQL 3.0.9 as the patched version.
A CVE entry documented CVE-2026-48772 as affecting ProxySQL versions 2.0.0 through 3.0.8 and identified version 3.0.9 as the fix. It described the issue as remotely exploitable source-IP spoofing via malformed HAProxy PROXY protocol v1 header handling.
ProxySQL 3.0.9 was released and remediated CVE-2026-48772, the critical source-IP spoofing issue caused by malformed handling of PROXY protocol v1 `UNKNOWN` headers. The release notes urged users on 3.0.8 or earlier to upgrade.
A GitHub security advisory described a ProxySQL flaw in PROXY protocol v1 parsing that lets attackers send a `PROXY UNKNOWN` frame with forged address fields, causing spoofed client IPs to be used in ACLs, routing, and logs. The advisory said the issue was confirmed in the 3.0.x line and also present in current master.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
ccb.belgium.be
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two newly disclosed vulnerabilities affect **HAProxy through version 3.4.0**, including **`CVE-2026-55203`**, a critical integer overflow in FastCGI handling that can be triggered by a malicious FastCGI backend. The bug resides in the `fcgi_conn` structure’s `drl` field: when `contentLength` is `65535` and `paddingLength` is `1` or greater, the value wraps to `0`, causing the parser to treat buffered data as new FastCGI record headers. That desynchronization can lead to request routing errors, **response smuggling**, and possible memory-safety impacts. The issue is described as remotely exploitable and was fixed in commit `5985276`. A second flaw, **`CVE-2026-55204`**, is a high-severity **NULL pointer dereference** in `hpack_dht_insert()` within `src/hpack-tbl.c`. The vulnerability occurs when HAProxy fails to validate the return value of `hpack_dht_defrag()` after memory-pool exhaustion, allowing a remote attacker to trigger HPACK dynamic table insertions under memory pressure and crash HAProxy worker processes, resulting in denial of service. The bug is fixed in commit `9a6d1fe`, and affected organizations should update HAProxy to a release containing both fixes.
Jun 29, 2026
Two high-severity vulnerabilities in **OAuth2 Proxy** can let unauthenticated remote attackers reach protected upstream resources in specific reverse-proxy deployments. `CVE-2026-34457` affects versions prior to **7.15.2** when OAuth2 Proxy is used with **auth_request**-style integrations such as nginx `auth_request` and either `--ping-user-agent` or `--gcp-healthchecks` is enabled. In that configuration, any request carrying the configured health-check User-Agent can be treated as a successful health check regardless of the requested path, creating an authentication bypass. The flaw is tracked as **CWE-290** and carries a **CVSS 3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`. A second flaw, `CVE-2026-40575`, affects OAuth2 Proxy versions **7.5.0 through 7.15.1** when `--reverse-proxy` is enabled alongside `--skip-auth-regex` or `--skip-auth-route`. In those setups, the product may trust a client-supplied `X-Forwarded-Uri` header, allowing attackers to spoof the header so authentication and skip-auth rules are evaluated against a different path than the one actually forwarded upstream. Both issues were fixed in **OAuth2 Proxy 7.15.2**. Recommended mitigations include upgrading immediately, stripping or overwriting `X-Forwarded-Uri`, restricting direct access to OAuth2 Proxy, and narrowing or removing skip-auth rules where possible.
Jun 29, 2026
Apache Syncope disclosed **CVE-2026-57308**, an important SQL injection vulnerability in the Audit Events search functionality that can let an authenticated administrator with sufficient entitlements execute arbitrary SQL through stacked queries. The issue is caused by improper neutralization of special elements in SQL commands, specifically unsanitized `sort` parameters handled by the application. The vulnerability affects Apache Syncope versions `3.0.0-M0` through `3.0.16`, `4.0.0-M0` through `4.0.6`, and `4.1.0-M0` through `4.1.1`. Apache advised users to upgrade to **4.0.7** or **4.1.2** to remediate the flaw, and credited **Lennart Hostettler** with reporting the issue.
Jul 20, 2026