CVE-2026-58172
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Ocelot through version 24.1.0 has a security control bypass vulnerability. Denied clients can send WebSocket upgrade requests that bypass IP-based access restrictions.
Risk Assessment
The risk is that blocked individuals or systems can gain unauthorized access to downstream services via WebSocket, potentially leading to network security breaches.
Recommendation
Immediately update Ocelot to a version containing the fix from commit f156fd4 or later to restore enforcement of IP access rules for WebSocket requests.
Original NVD description (English source)
Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream services without enforcement of the configured allow/block list.