CVE-2026-71485
Description
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.
How to fix
- github.com/centrifugal/centrifugo6.9.0 or later
- github.com/centrifugal/centrifugo/v66.9.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/centrifugal/centrifugoGo | v < 6.9.0, No range specified | 6.9.0 |
| github.com/centrifugal/centrifugo/v3Go | No range specified | — |
| github.com/centrifugal/centrifugo/v4Go | No range specified | — |
| github.com/centrifugal/centrifugo/v5Go | No range specified | — |
| github.com/centrifugal/centrifugo/v6Go | v < 6.9.0 | 6.9.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.