CVE-2026-71485
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Centrifugo before version 6.9.0 allows a remote client to spoof headers such as x-trusted-user in connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The vulnerability arises from copying client-controlled headers into the connection context and forwarding them as trusted backend headers.
Risk Assessment
An attacker could impersonate a trusted user and gain unauthorized access to functions or data if the backend uses these headers for authorization.
Recommendation
Upgrade Centrifugo to version 6.9.0 or later, which includes the fix.
Other vulnerabilities in Centrifugo
See all- CVE-2026-62963High
In Centrifugo before version 6.8.4, the unidirectional WebSocket transport with compression enabled enforced message size limit before decompression, but after decompression there was no output cap. This allowed unauthenticated requests to /connection/uni_websocket to trigger high memory and CPU consumption.
- CVE-2026-49998High
In Centrifugo before version 6.8.1, dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer. This occurred because the JWKS cache and singleflight lookup were keyed only by the JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace.
Original NVD description (English source)
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS