Junglewise Threat Intelligence
CVE-2026-32301: GO-2026-4702 - Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL in github.com/centrifugal/centrifugo
CVE-2026-32301 · Severity: low · CVSS 3.1 · Published 2026-03-26
Technologies: github.com/centrifugal/centrifugo/v4 (Go), github.com/centrifugal/centrifugo/v3 (Go), github.com/centrifugal/centrifugo/v6 (Go), github.com/centrifugal/centrifugo (Go), github.com/centrifugal/centrifugo/v5 (Go). Vendors: Go.
Executive brief
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL in github.com/centrifugal/centrifugo
Affected products
- Go github.com/centrifugal/centrifugo/v4
- Go github.com/centrifugal/centrifugo/v3
- Go github.com/centrifugal/centrifugo/v6
- Go github.com/centrifugal/centrifugo
- Go github.com/centrifugal/centrifugo/v5