CVE-2026-71485

Received Received - Intake

Centrifugo Header Spoofing via Client-Controlled Headers

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-71485

Affected Vendors & Products

Vendor	Product	Version / Range
centrifugal	centrifugo	6.9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability in Centrifugo versions before 6.9.0 allows a remote client to spoof HTTP headers like x-trusted-user during connect, refresh, subscribe, publish, RPC, and proxy calls. The issue occurs because client-controlled headers are copied through multiple internal functions and forwarded as trusted backend headers or metadata. The gRPC transport lacks HTTP header override protection for emulated values.

Impact Analysis

An attacker could impersonate legitimate users by spoofing authentication or authorization headers. This could grant unauthorized access to sensitive data, allow privilege escalation, or enable actions the attacker is not permitted to perform. Systems relying on these headers for security decisions are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Compliance may be compromised if authentication or authorization mechanisms are bypassed, potentially resulting in data breaches or unauthorized processing of personal health information.

Mitigation Strategies

Upgrade Centrifugo to version 6.9.0 or later to address the header spoofing vulnerability. Review proxy configurations to ensure trusted headers are properly validated and not forwarded from client-controlled inputs.

Hi! I’m here to help you understand CVE-2026-71485. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70