Github.Com Centrifugal Centrifugo V4 vulnerabilities

1 known vulnerability affecting github.com/centrifugal_centrifugo_v4.

Total CVEs

1

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

CRITICAL1

Vulnerabilities

Page 1 of 1

CVE-2026-32301CRITICAL≥ 0, ≤ 4.1.52026-03-13

CVE-2026-32301 [CRITICAL] CWE-918 Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL ### Summary Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. `{{tenant}}`). An unauthenticated attacker can craft a JWT with a malicious `iss` or `aud` claim value that gets interpolated into the J