Executive brief
Ocelot, a popular .NET API Gateway, contains a security flaw where IP-based access restrictions can be bypassed. While the gateway correctly blocks unauthorized IP addresses for standard web traffic, it fails to apply these same restrictions to WebSocket connection requests. This allows blocked users to establish persistent connections to internal services, potentially leading to unauthorized data access or service manipulation.
Technical details
A security bypass vulnerability exists in Ocelot's request pipeline configuration within OcelotPipelineExtensions.cs. While standard HTTP requests pass through SecurityMiddleware, WebSocket upgrade requests are forked via MapWhen into a separate pipeline that lacks this middleware. Consequently, IPSecurityPolicy is never executed for these requests, allowing clients with IP addresses explicitly listed in SecurityOptions.IPBlockedList to successfully upgrade to a WebSocket connection and access downstream services. The vulnerability is fixed in commit f156fd4 by integrating SecurityMiddleware into the WebSocket pipeline and ensuring denied upgrades return a 403 Forbidden status.
Affected products
- ThreeMammals Ocelot through 24.1.0
Timeline
- 2026-06-22: disclosed: Issue reported on GitHub
- 2026-06-27: patched: Fix merged into develop branch via commit f156fd4
- 2026-06-30: advisory: CVE-2026-58172 published