CVE-2026-71485: Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Centrifugoto a version that resolves this vulnerability.Fixed in 6.9.0
Event History
Frequently Asked Questions
Which deployments are realistically exposed to spoofed backend identity or authorization data?
Deployments are exposed when Centrifugo forwards allowlisted emulated headers or metadata to HTTP, gRPC, or unidirectional gRPC proxy backends, and those backends trust a forwarded value for authentication or authorization. A client can spoof values such as x-trusted-user in affected versions prior to 6.9.0.
Does exploitation require an authenticated client account or user interaction?
No. The vulnerability has network attack vector, low attack complexity, no privileges required, and no user interaction required. A remote client can supply forged header values during connect, refresh, subscribe, publish, RPC, and related proxy calls.
Are all proxy transports affected in the same way?
The HTTP proxy requestHeaders path, gRPC proxy requestMetadata path, and unidirectional gRPC Consume path can forward allowlisted emulated values. For unidirectional gRPC, there is no transport-level HTTP header that can override the emulated value.
What is the available remediation?
Upgrade Centrifugo to version 6.9.0, which fixes the issue. Until upgrading, avoid relying on Centrifugo-forwarded emulated headers or metadata as trusted authentication or authorization inputs in affected proxy backends.