CVE-2026-71485

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.

• CWE-290

• https://github.com/centrifugal/centrifugo/commit/84d38cea1dd2efa24375a148817a974c8727f4b0
• https://github.com/centrifugal/centrifugo/pull/1182
• https://github.com/centrifugal/centrifugo/releases/tag/v6.9.0
• https://github.com/centrifugal/centrifugo/security/advisories/GHSA-9468-v6mj-fppw

Published

Aug 20, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71476Nx is a monorepo solution for TypeScript and polyglot codeba…8.7
• CVE-2026-71477mise manages dev tools like node, python, cmake, and terrafo…6.7
• CVE-2026-71478league/commonmark is a PHP library for parsing and rendering…6.1
• CVE-2026-71479New API is a large language mode (LLM) gateway and artificia…9.1
• CVE-2026-7148A flaw has been found in CodeAstro Online Classroom 1.0. Thi…6.3
• CVE-2026-71483Horilla is an HR and CRM software. Prior to 1.6.0, the searc…8.5
• CVE-2026-71486vLLM is an inference and serving engine for large language m…4.3
• CVE-2026-71488league/commonmark is a PHP library for parsing and rendering…7.5
• CVE-2026-7149A vulnerability has been found in dexhunter kaggle-mcp up to…7.3
• CVE-2026-71491sqlparse is a non-validating SQL parser module for Python. P…8.7
• CVE-2026-71492Banks generates meaningful LLM prompts using a simple templa…6
• CVE-2026-71493Infracost provides cloud cost intelligence for engineers, AI…5.9