CVE-2026-71485: Centrifugo header spoofing via client-controlled emulation

CVE-2026-71485 · Severity: critical · CVSS 9.1 · Published 2026-08-20

Centrifugo is a real-time messaging server that relays client connections to backend services via proxy requests, forwarding selected HTTP headers and gRPC metadata for authentication and access control. An attacker can inject arbitrary header values in the connection message, which Centrifugo forwards to the backend exactly as if they came from a trusted reverse proxy. This allows complete spoofing of identity headers and authentication bypass without any credentials, potentially granting an attacker unauthorized access to backend resources for the lifetime of the connection.

Technologies: Centrifugal Centrifugo, github.com/centrifugal/centrifugo (Go), github.com/centrifugal/centrifugo/v3 (Go), github.com/centrifugal/centrifugo/v4 (Go), github.com/centrifugal/centrifugo/v5 (Go), github.com/centrifugal/centrifugo/v6 (Go). Vendors: Centrifugal, Go.

Quick answers

Is CVE-2026-71485 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71485 being exploited in the wild.
How severe is CVE-2026-71485?
Critical severity, with a CVSS score of 9.1, published 20 August 2026.
Which products and versions are affected?
Centrifugal Centrifugo <= 6.8.4; github.com/centrifugal/centrifugo (Go) <= 6.8.4, SEMVER:introduced=0, SEMVER:introduced=0,fixed=6.9.0; github.com/centrifugal/centrifugo/v3 (Go) SEMVER:introduced=0; github.com/centrifugal/centrifugo/v4 (Go) SEMVER:introduced=0; and 2 more.
Is there a fix for CVE-2026-71485?
Yes. github.com/centrifugal/centrifugo (Go): upgrade to 6.9.0 or later; github.com/centrifugal/centrifugo/v6 (Go): upgrade to 6.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71485 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-71485?
Check whether you run Centrifugal Centrifugo, github.com/centrifugal/centrifugo (Go), github.com/centrifugal/centrifugo/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/centrifugal/centrifugo (Go): upgrade to 6.9.0 or later
    go get github.com/centrifugal/centrifugo@v6.9.0
  • github.com/centrifugal/centrifugo/v6 (Go): upgrade to 6.9.0 or later
    go get github.com/centrifugal/centrifugo/v6@v6.9.0

Technical details

The vulnerability stems from confusion between client-controlled header emulation and genuine transport-layer headers. Centrifugo's wire protocol (`protocol.ConnectRequest`) includes a client-supplied `headers` map that is copied verbatim into an "emulated headers" context and forwarded to all proxy call types (connect, refresh, subscribe, publish, rpc, etc.). The `requestHeaders()` function in `internal/proxy/http.go` only overrides these values with real HTTP headers if an identical header name appears on the underlying transport request. For the unidirectional gRPC transport, there is no HTTP request at all, so the client value always wins. An attacker connecting directly to Centrifugo can send arbitrary header values in the connect message; if that header name is in the operator's `http_headers` or `grpc_metadata` allowlist, it will be forwarded to the backend as if from a trusted intermediary. Patch: 6.9.0+.

Affected products

  • Centrifugal Centrifugo <= 6.8.4

Identifiers

  • CVE-2026-71485
  • GHSA-9468-v6mj-fppw
  • GO-2026-6490

Timeline

  • 2026-09-02: disclosed: Advisory published by GitHub
  • 2026-08-20: advisory: Published to National Vulnerability Database
  • 2026-06-01: patched: Fixed in version 6.9.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.