{"id":"CVE-2026-71485","title":"Centrifugo is an open-source scalable real-time messaging server","summary":"Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers,…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-290"],"vendor":"centrifugal","product":"github.com/centrifugal/centrifugo","affected":["github.com/centrifugal/centrifugo < 6.9.0"],"patched":["github.com/centrifugal/centrifugo 6.9.0"],"published":"2026-08-20","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71485","references":[{"url":"https://github.com/centrifugal/centrifugo/commit/84d38cea1dd2efa24375a148817a974c8727f4b0","label":"security-advisories@github.com"},{"url":"https://github.com/centrifugal/centrifugo/pull/1182","label":"security-advisories@github.com"},{"url":"https://github.com/centrifugal/centrifugo/releases/tag/v6.9.0","label":"security-advisories@github.com"},{"url":"https://github.com/centrifugal/centrifugo/security/advisories/GHSA-9468-v6mj-fppw","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71485"},{"url":"https://github.com/centrifugal/centrifugo"},{"url":"https://github.com/advisories/GHSA-9468-v6mj-fppw"}],"tags":["nvd","osv","go","ghsa"],"epss":0.00423,"epssPercentile":0.36224,"aliases":["GHSA-9468-v6mj-fppw"],"ecosystem":"go","ingestedAt":"2026-09-03T19:32:13.172Z","slug":"CVE-2026-71485","body":"## Overview\n\nCentrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-71485)\n\nAffected packages:\n\n- `github.com/centrifugal/centrifugo < 6.9.0`\n\nPatched in:\n\n- `github.com/centrifugal/centrifugo 6.9.0`\n\nSource: https://osv.dev/vulnerability/GHSA-9468-v6mj-fppw","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}