CVE-2026-71485

Name of the Vulnerable Software and Affected Versions Centrifugo versions prior to 6.9.0

Description Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. This allows a remote client to spoof headers, such as x-trusted-user, during connect, refresh, subscribe, publish, RPC, and related proxy calls if the backend relies on those headers for authentication or authorization. Additionally, the unidirectional gRPC transport lacks a transport-level HTTP header to override the emulated value.

Recommendations Update to version 6.9.0.