Disclosed exit-IP assignment behaviour that could link sessions across servers
Mullvad disclosed that it became aware on 15 May 2026 of a fingerprinting issue: a client reconnecting through a different server was likely to receive an exit address at the same relative position in that server's range, which could let an observer infer that the same user had moved between servers. The company said this does not reveal a user's identity and that a change in behaviour was being tested for rollout in the following weeks.
This entry summarises a public report and links to it. It is a record of what was reported, not a finding of wrongdoing. If you represent Mullvad VPN, you can
claim the listing and respond here. To correct an error, send a correction.
