Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-58172Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests

Critical 9.1

In plain English

A critical-severity authentication bypass in Ocelot from ThreeMammals. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.6%top 52.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream services without enforcement of the configured allow/block list.

Affected products (as reported)

Vendor	Product	Versions
ThreeMammals	Ocelot	0 – through 24.1.0

Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Researcher Disclosure technical-description, exploit
Fix PR issue-tracking
Fix Commit patch
https://www.vulncheck.com/advisories/ocelot-ip-allow-block-list-bypass-for-websocket-upgrade-requests third-party-advisory