Vulnerability · Published Aug 20, 2026 · Assigned by GitHub_M

CVE-2026-71485Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Critical 9.1

In plain English

A critical-severity authentication bypass by spoofing in centrifugo from centrifugal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.6%top 50.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/centrifugal/centrifugo	6.9.0	GHSA-9468-v6mj-fppw
Go	github.com/centrifugal/centrifugo	no fix listed	GO-2026-6490
Go	github.com/centrifugal/centrifugo/v3	no fix listed	GO-2026-6490
Go	github.com/centrifugal/centrifugo/v4	no fix listed	GO-2026-6490
Go	github.com/centrifugal/centrifugo/v5	no fix listed	GO-2026-6490
Go	github.com/centrifugal/centrifugo/v6	6.9.0	GO-2026-6490

Affected products (as reported)

Vendor	Product	Versions
centrifugal	centrifugo	< 6.9.0

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/centrifugal/centrifugo/security/advisories/GHSA-9468-v6mj-fppw x_refsource_CONFIRM
https://github.com/centrifugal/centrifugo/pull/1182 x_refsource_MISC
https://github.com/centrifugal/centrifugo/commit/84d38cea1dd2efa24375a148817a974c8727f4b0 x_refsource_MISC
https://github.com/centrifugal/centrifugo/releases/tag/v6.9.0 x_refsource_MISC