CVE-2026-71485: falha crítica em centrifugal centrifugo
Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.6%
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
centrifugal · centrifugoCVEs relacionadas — centrifugal centrifugo
No mesmo produto, das mais perigosas para as menos.
CVE-2026-62963HIGHCentrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transportEPSS 0.5%CVE-2026-32301CRITICALCentrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URLEPSS 0.3%CVE-2026-49998HIGHCentrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypassEPSS 0.2%