github.com/centrifugal/centrifugo

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Critical 9.1

CVE-2026-71485

Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeader…

centrifugal centrifugo github.com/centrifugal/centrifugo/v3 github.com/centrifugal/centrifugo/v6 Go

Aug 20, 2026
Critical 9.3

CVE-2026-32301

Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated at…

centrifugal centrifugo github.com/centrifugal/centrifugo/v4 github.com/centrifugal/centrifugo Go

Mar 12, 2026