Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

• CVE-2026-71485: 0.61% estimated exploitation activity in the next 30 days; percentile 49.23 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Vulnerability Details File: internal/client/handler.go (OnClientConnecting), internal/proxy/http.go (requestHeaders), internal/proxy/grpc.go (requestMetadata), internal/unigrpc/grpc.go (Consume) Line: handler.go:389,548-552 (e.Headers - SetEmulatedHeadersToContext), http.go:131-165 (requestHeaders), grpc.go:82-114 (requestMetadata), unigrpc/grpc.go:46 (Headers: req.Headers) Root Cause The httpheaders / grpcmetadata proxy config options are documented as "List of incoming HTTP header names to forward to the proxy backend" / "List of incoming gRPC metadata keys to forward to the proxy backend" -- implying the value originates from the underlying transport connection (e.g. set by a trusted reverse proxy/API gateway in front of Centrifugo). Operators commonly use this to forward identity/trust headers to their own backend for access-control decisions. However, the wire protocol used by every Centrifugo transport (protocol.ConnectRequest, field headers) includes a headers map populated…

Published by the source

2 Sep 2026, 23:41 UTC

Last modified by the source

28 Sep 2026, 17:00 UTC

Source last checked

26 Oct 2026, 15:29 UTC

1. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-9468-v6mj-fppw

2. Revision 2 · amended · 24 Oct 2026

   Amended from osv record GO-2026-6490

3. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-9468-v6mj-fppw

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-71485

Advisory: Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends
IDs: CVE-2026-71485, GHSA-9468-v6mj-fppw
Record: https://patchnext.com/advisories/cve-2026-71485 (revision 3, source checked 26 Oct 2026, 15:29 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Partial vendor fix; fixed versions by package: github.com/centrifugal/centrifugo/v6 6.9.0; github.com/centrifugal/centrifugo 6.9.0. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/centrifugal/centrifugo/v5: affected every version
- Go github.com/centrifugal/centrifugo/v4: affected every version
- Go github.com/centrifugal/centrifugo/v3: affected every version
- Go github.com/centrifugal/centrifugo/v6: affected < 6.9.0; fixed in 6.9.0
- Go github.com/centrifugal/centrifugo: affected <= 6.8.4; fixed in 6.9.0

## Suggested inspection (read-only)
- Go github.com/centrifugal/centrifugo/v5: check the installed version with your package manager.
- Go github.com/centrifugal/centrifugo/v4: check the installed version with your package manager.
- Go github.com/centrifugal/centrifugo/v3: check the installed version with your package manager.
- Go github.com/centrifugal/centrifugo/v6: check the installed version with your package manager.
- Go github.com/centrifugal/centrifugo: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/centrifugal/centrifugo/v5, github.com/centrifugal/centrifugo/v4, github.com/centrifugal/centrifugo/v3, github.com/centrifugal/centrifugo/v6, github.com/centrifugal/centrifugo.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-9468-v6mj-fppw (OSV record GHSA-9468-v6mj-fppw lists affected ranges: Go github.com/centrifugal/centrifugo >=0 <6.9.0 (fixed))
- Verified: https://osv.dev/vulnerability/GO-2026-6490 (OSV record GO-2026-6490 lists affected ranges: Go github.com/centrifugal/centrifugo >=0; Go github.com/centrifugal/centrifugo/v3 >=0; Go github.com/centrifugal/centrifugo/v4 >=0; Go github.com/centrifugal/centrifugo/v5 >=0; Go github.com/centrifugal/centrifugo/v6 >=0 <6.9.0 (fixed))
- Verified: https://github.com/advisories/GHSA-9468-v6mj-fppw (GitHub-reviewed advisory GHSA-9468-v6mj-fppw lists affected ranges: Go github.com/centrifugal/centrifugo >=0 <=6.8.4)

Commands are suggestions: review each one before running it.