CVE-2026-32301
published 2026-03-13CVE-2026-32301: Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when…
PriorityP358critical9.3CVSS 3.1
AVNACLPRNUINSCCHILAN
EPSS
0.26%
17.1th percentile
Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated attacker can craft a JWT with a malicious iss or aud claim value that gets interpolated into the JWKS fetch URL before the token signature is verified, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination. This vulnerability is fixed in 6.7.0.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| centrifugal | centrifugo | < 6.7.0 | 6.7.0 |
| github.com | centrifugal_centrifugo | 0 – 2.4.0 | — |
| github.com | centrifugal_centrifugo_v3 | 0 – 3.2.3 | — |
| github.com | centrifugal_centrifugo_v4 | 0 – 4.1.5 | — |
| github.com | centrifugal_centrifugo_v5 | 0 – 5.4.9 | — |
| github.com | centrifugal_centrifugo_v6 | >= 0 < 6.7.0 | 6.7.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL in github.com/centrifugal/centrifugo
osv·2026-03-26
CVE-2026-32301 Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL in github.com/centrifugal/centrifugo
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL in github.com/centrifugal/centrifugo
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL in github.com/centrifugal/centrifugo
GHSA
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
ghsa·2026-03-13
CVE-2026-32301 [CRITICAL] CWE-918 Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
### Summary
Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. `{{tenant}}`). An unauthenticated attacker can craft a JWT with a malicious `iss` or `aud` claim value that gets interpolated into the JWKS fetch URL **before the token signature is verified**, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination.
### Details
In `internal/jwtverify/token_verifier_jwt.go`, the functions `VerifyConnectToken` and `VerifySubscribeToken` follow this flawed order of operations:
1. Token is parsed without verification: `jwt.ParseNoVerify([]byte(t))`
2. Claims are decoded from the unverif
OSV
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
osv·2026-03-13
CVE-2026-32301 [CRITICAL] Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
### Summary
Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. `{{tenant}}`). An unauthenticated attacker can craft a JWT with a malicious `iss` or `aud` claim value that gets interpolated into the JWKS fetch URL **before the token signature is verified**, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination.
### Details
In `internal/jwtverify/token_verifier_jwt.go`, the functions `VerifyConnectToken` and `VerifySubscribeToken` follow this flawed order of operations:
1. Token is parsed without verification: `jwt.ParseNoVerify([]byte(t))`
2. Claims are decoded from the unverif
No detection rules found.
No public exploits indexed.
2026-03-13
Published