Spoofing Vulnerability in Centrifugo Real-Time Messaging Server

CVE-2026-71485

What is CVE-2026-71485?

Centrifugo, an open-source scalable real-time messaging server, has a vulnerability in its handling of client-controlled headers prior to version 6.9.0. The vulnerability arises from the improper copying of the ConnectRequest.headers, allowing remote clients to spoof critical headers such as x-trusted-user. This can lead to unauthorized access, as the backend may trust these emulated values for authentication and authorization. Affected functions include Connect, refresh, subscribe, and publish actions, which can be exploited via gRPC and HTTP proxy calls.

References