{"id":"CVE-2026-71485","sourceIdentifier":"security-advisories@github.com","published":"2026-08-20T21:17:08.707","lastModified":"2026-10-18T20:10:00.110","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0."},{"lang":"es","value":"Centrifugo es un servidor de mensajería en tiempo real escalable de código abierto. Antes de la versión 6.9.0, Centrifugo copia el mapa de encabezados de protocol.ConnectRequest controlado por el cliente a través de OnClientConnecting en internal/client/handler.go, ConnectEvent.Headers y SetEmulatedHeadersToContext. La ruta requestHeaders en internal/proxy/http.go, la ruta requestMetadata en internal/proxy/grpc.go y la ruta Consume en internal/unigrpc/grpc.go pueden reenviar un valor en lista blanca como un encabezado o valor de metadatos de backend de confianza. Un cliente remoto puede suplantar un encabezado como 'x-trusted-user' para llamadas de conexión, actualización, suscripción, publicación, RPC y llamadas de proxy relacionadas cuando el backend depende de ese encabezado para la autenticación o autorización. El transporte gRPC unidireccional no tiene ningún encabezado HTTP a nivel de transporte que pueda anular el valor emulado. Este problema se corrige en la versión 6.9.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"centrifugal","product":"centrifugo","versions":[{"version":"< 6.9.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-25T15:23:30.574802Z","id":"CVE-2026-71485","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://github.com/centrifugal/centrifugo/commit/84d38cea1dd2efa24375a148817a974c8727f4b0","source":"security-advisories@github.com"},{"url":"https://github.com/centrifugal/centrifugo/pull/1182","source":"security-advisories@github.com"},{"url":"https://github.com/centrifugal/centrifugo/releases/tag/v6.9.0","source":"security-advisories@github.com"},{"url":"https://github.com/centrifugal/centrifugo/security/advisories/GHSA-9468-v6mj-fppw","source":"security-advisories@github.com"}]}