Description

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-20T21:17:08.707Z",
  "pubdate": "2026-08-20T21:17:08.707Z",
  "executiveSummary": "Centrifugo prior to version 6.9.0 is affected by a client header spoofing vulnerability involving the mishandling of client-controlled protocol connection requests and proxy forwarding mechanisms. The root vulnerability allows remote clients to manipulate and inject arbitrary values into internal maps and context structures, specifically targeting headers or metadata fields that backends trust for authentication and authorization decisions. An unauthenticated or remote attacker can exploit this flaw to bypass security controls by spoofing trusted headers such as x-trusted-user across various operations including connect, refresh, subscribe, publish, RPC, and related proxy calls. The risk implications are severe, as dependent backend architectures relying on these emulated headers for security enforcement can be entirely compromised, allowing unauthorized access and privilege escalation. The vulnerability stems from improper trust boundary enforcement where untrusted client input is incorrectly propagated into trusted backend communication channels without adequate sanitization or strict allowlist validation.",
  "technicalDetails": "The vulnerability resides in Centrifugo's handling of client-controlled protocol data within several core components. Specifically, the software improperly copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting located in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. Additionally, the requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go forward allowlisted values as trusted backend headers or metadata values. The root cause is an insecure data flow where client-supplied inputs are mapped into execution contexts that downstream systems interpret as authenticated, trusted proxy attributes. Exploitation occurs when a remote client crafts a malicious payload containing spoofed headers, such as x-trusted-user, during client connection or subsequent protocol operations like refresh, subscribe, publish, RPC, and related proxy invocations. Because the unidirectional gRPC transport lacks a transport-level HTTP header capable of overriding the emulated value, the spoofed headers are accepted and processed directly by the backend service. This architectural flaw allows malicious actors to impersonate arbitrary users or elevate privileges if the receiving backend relies blindly on the integrity of the forwarded headers or metadata for authorization and authentication decisions. The affected versions include all Centrifugo releases prior to 6.9.0, operating across network-exposed endpoints where clients interact directly with the messaging server."
}