Executive brief
Centrifugo is a real-time messaging server that relays client connections to backend services via proxy requests, forwarding selected HTTP headers and gRPC metadata for authentication and access control. An attacker can inject arbitrary header values in the connection message, which Centrifugo forwards to the backend exactly as if they came from a trusted reverse proxy. This allows complete spoofing of identity headers and authentication bypass without any credentials, potentially granting an attacker unauthorized access to backend resources for the lifetime of the connection.
Technical details
The vulnerability stems from confusion between client-controlled header emulation and genuine transport-layer headers. Centrifugo's wire protocol (`protocol.ConnectRequest`) includes a client-supplied `headers` map that is copied verbatim into an "emulated headers" context and forwarded to all proxy call types (connect, refresh, subscribe, publish, rpc, etc.). The `requestHeaders()` function in `internal/proxy/http.go` only overrides these values with real HTTP headers if an identical header name appears on the underlying transport request. For the unidirectional gRPC transport, there is no HTTP request at all, so the client value always wins. An attacker connecting directly to Centrifugo can send arbitrary header values in the connect message; if that header name is in the operator's `http_headers` or `grpc_metadata` allowlist, it will be forwarded to the backend as if from a trusted intermediary. Patch: 6.9.0+.
Affected products
- Centrifugal Centrifugo <= 6.8.4
Timeline
- 2026-09-02: disclosed: Advisory published by GitHub
- 2026-08-20: advisory: Published to National Vulnerability Database
- 2026-06-01: patched: Fixed in version 6.9.0
References
- https://api.github.com/users/iaohkut-from-NightWolf-Team
- https://github.com/iaohkut-from-NightWolf-Team
- https://api.github.com/users/iaohkut-from-NightWolf-Team/gists%7B/gist_id%7D
- https://api.github.com/users/iaohkut-from-NightWolf-Team/repos
- https://avatars.githubusercontent.com/u/286391906?v=4
- https://api.github.com/users/iaohkut-from-NightWolf-Team/events%7B/privacy%7D