CVE-2026-71485 Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

What is CVE-2026-71485?

CVE-2026-71485 is a critical authentication bypass vulnerability in centrifugal centrifugo, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.

Weakness: CWE-290

Which versions are affected by CVE-2026-71485?

7 open source packages ship an affected version, including github.com/centrifugal/centrifugo, github.com/centrifugal/centrifugo/v3 and github.com/centrifugal/centrifugo/v4.

How do I fix CVE-2026-71485?

Upgrade github.com/centrifugal/centrifugo to 6.9.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-71485 being exploited?

There is no known exploitation of CVE-2026-71485 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9468-v6mj-fppw, GO-2026-6490.