CVE-2026-32301 Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
An unauthenticated attacker can trigger SSRF in Centrifugo by crafting JWT claims that influence the dynamic JWKS endpoint URL before signature verification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32301?
CVE-2026-32301 is a critical server-side request forgery vulnerability in centrifugal centrifugo, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated attacker can craft a JWT with a malicious iss or aud claim value that gets interpolated into the JWKS fetch URL before the token signature is verified, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination. This vulnerability is fixed in 6.7.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-32301?
15 open source packages ship an affected version, including github.com/centrifugal/centrifugo, github.com/centrifugal/centrifugo/v3 and github.com/centrifugal/centrifugo/v4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/centrifugal/centrifugo Go | All versions | None |
github.com/centrifugal/centrifugo Go | All versions to 2.4.0 | None |
github.com/centrifugal/centrifugo Go | All versions to 2.4.0 | None |
github.com/centrifugal/centrifugo/v3 Go | All versions | None |
github.com/centrifugal/centrifugo/v3 Go | All versions to 3.2.3 | None |
github.com/centrifugal/centrifugo/v3 Go | All versions to 3.2.3 | None |
9 more packages
github.com/centrifugal/centrifugo/v4 Go | All versions | None |
github.com/centrifugal/centrifugo/v4 Go | All versions to 4.1.5 | None |
github.com/centrifugal/centrifugo/v4 Go | All versions to 4.1.5 | None |
github.com/centrifugal/centrifugo/v5 Go | All versions | None |
github.com/centrifugal/centrifugo/v5 Go | All versions to 5.4.9 | None |
github.com/centrifugal/centrifugo/v5 Go | All versions to 5.4.9 | None |
github.com/centrifugal/centrifugo/v6 Go | All versions | 6.7.0 |
github.com/centrifugal/centrifugo/v6 Go | All versions | 6.7.0 |
github.com/centrifugal/centrifugo/v6 Go | All versions | 6.7.0 |
Products include Centrifugal Centrifugo.
How do I fix CVE-2026-32301?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-32301 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32301 exists.
Sources
Also known as GHSA-j77h-rr39-c552, GO-2026-4702.