{"id":"EUVD-2026-63649","enisaUuid":"0e87ef26-7566-3b01-bba1-5cf71ffb4ebe","description":"Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.","datePublished":"Aug 20, 2026, 9:01:00 PM","dateUpdated":"Aug 25, 2026, 3:23:47 PM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/centrifugal/centrifugo/security/advisories/GHSA-9468-v6mj-fppw\nhttps://github.com/centrifugal/centrifugo/pull/1182\nhttps://github.com/centrifugal/centrifugo/commit/84d38cea1dd2efa24375a148817a974c8727f4b0\nhttps://github.com/centrifugal/centrifugo/releases/tag/v6.9.0\n","aliases":"CVE-2026-71485\nGHSA-9468-v6mj-fppw\n","assigner":"GitHub_M","epss":0.61,"enisaIdProduct":[{"id":"60b1af8f-1054-3c59-b5f6-3fb15ec27c7d","product":{"name":"centrifugo","vendor":{"name":"centrifugal"}},"product_version":"\u003c 6.9.0"}],"enisaIdVendor":[{"id":"26fc6a62-a0d8-3305-9506-ec7e595a1c76","vendor":{"name":"centrifugal"}}],"enisaIdVulnerability":[{"id":"1c33f850-a092-37d5-be31-4ee57c424413","vulnerability":{"id":"GHSA-9468-v6mj-fppw","description":"Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends","datePublished":"Sep 2, 2026, 11:41:37 PM","dateUpdated":"Sep 17, 2026, 4:35:33 PM","baseScore":0.0,"references":"https://github.com/centrifugal/centrifugo/security/advisories/GHSA-9468-v6mj-fppw\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71485\nhttps://github.com/centrifugal/centrifugo/pull/1182\nhttps://github.com/centrifugal/centrifugo/commit/84d38cea1dd2efa24375a148817a974c8727f4b0\nhttps://github.com/centrifugal/centrifugo\nhttps://github.com/centrifugal/centrifugo/releases/tag/v6.9.0\n","enisa_id":"EUVD-2026-63649\n","aliases":"CVE-2026-71485\nGHSA-9468-v6mj-fppw\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"dbd83d20-a84c-35a7-a14d-60c88f991666","vulnerability":{"id":"CVE-2026-71485","description":"Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.","datePublished":"Aug 20, 2026, 9:01:00 PM","dateUpdated":"Aug 25, 2026, 3:23:47 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","references":"https://github.com/centrifugal/centrifugo/security/advisories/GHSA-9468-v6mj-fppw\nhttps://github.com/centrifugal/centrifugo/pull/1182\nhttps://github.com/centrifugal/centrifugo/commit/84d38cea1dd2efa24375a148817a974c8727f4b0\nhttps://github.com/centrifugal/centrifugo/releases/tag/v6.9.0\n","enisa_id":"EUVD-2026-63649\n","assigner":"GitHub_M","epss":0.61,"dataProcessed":"Nov 1, 2026, 7:14:35 AM","vulnerabilityProduct":[{"id":"38ec7c0f-bc49-3e5b-9e2f-b92312ce20ab","product":{"name":"centrifugo","vendor":{"name":"centrifugal"}},"product_version":"\u003c 6.9.0"}],"vulnerabilityVendor":[{"id":"16375f62-c687-34fe-b98b-0bbc9a165256","vendor":{"name":"centrifugal"}}]}}],"enisaIdAdvisory":[]}