Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290.
Summary
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| centrifugal | centrifugo | before 6.9.0 | 6.9.0 | Patch available | CNA |
| — | github.com/centrifugal/centrifugo (Go) | before 6.9.0 | 6.9.0 | Patch available | GHSA-9468-v6mj-fppw |
- centrifugo Vendorcentrifugal Affected before 6.9.0 Fixed in 6.9.0 Patch available CNA
- github.com/centrifugal/centrifugo (Go) Vendor— Affected before 6.9.0 Fixed in 6.9.0 Patch available GHSA-9468-v6mj-fppw
Remediation
- Fix · CNA centrifugo (centrifugal) Fixed in 6.9.0
- Fix · GHSA-9468-v6mj-fppw github.com/centrifugal/centrifugo (Go) Fixed in 6.9.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-71485
- 2026-10-03 Alias added: GHSA-9468-v6mj-fppw
References
Other 5
- https://github.com/centrifugal/centrifugo/security/advisories/GHSA-9468-v6mj-fppw
- https://github.com/centrifugal/centrifugo/pull/1182
- https://github.com/centrifugal/centrifugo/commit/84d38cea1dd2efa24375a148817a974c8727f4b0
- https://github.com/centrifugal/centrifugo/releases/tag/v6.9.0
- https://github.com/centrifugal/centrifugo
More centrifugal vulnerabilities
- TI-2026-24830 Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL CVSS 3.1CRITICAL 9.3
- TI-2026-36829 Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass CVSS 3.1HIGH 8.2
- TI-2026-44987 Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport CVSS 4.0HIGH 8.7
Sources
- CVE-2026-71485 · CVE Program
- CVE-2026-71485 · NVD
- FIRST EPSS
- GHSA-9468-v6mj-fppw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences