CVE-2026-71485: Critical Header Injection in Centrifugo Real-Time Messaging Server

Executive Summary

A critical header injection vulnerability (CVE-2026-71485, CVSS 9.1) has been disclosed in Centrifugo, a widely used open-source scalable real-time messaging server. Versions prior to 6.9.0 copy the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting, ConnectEvent.Headers, and SetEmulatedHeadersToContext without adequate sanitization. This allows a malicious client to inject arbitrary headers into the server's internal request context, potentially affecting authorization logic, logging pipelines, proxied upstream services, or other header-dependent middleware.

Users of Centrifugo should upgrade to 6.9.0 or later immediately.

Vulnerability Details

Root Cause

Centrifugo processes WebSocket and HTTP-streaming connections. During connection setup, the client sends a ConnectRequest protobuf message that may include a headers map — typically used to forward original HTTP headers in emulated transport modes.

In the vulnerable code path (internal/client/handler.go), this map is copied verbatim through:

1. OnClientConnecting — the hook that fires when a new client connects
2. ConnectEvent.Headers — the event structure passed to server-side handlers
3. SetEmulatedHeadersToContext — which places these headers into the Go request context

Because the server trusts this client-supplied map as if it were the actual incoming HTTP headers, an unauthenticated or low-privilege client can supply arbitrary key-value pairs. Any downstream component that reads headers from the context (authorization middleware, proxy forwarding, audit logging, rate limiting) will then operate on attacker-controlled values.

Impact

Depending on how Centrifugo is deployed and what components consume headers from context, the impact can include:

• Authorization bypass: If a proxy or middleware grants elevated access based on specific header values (e.g., X-User-Role: admin, X-Internal-Request: true), a client can self-elevate
• SSRF / request smuggling: Injected headers forwarded to upstream services may alter routing or trigger unintended backend behavior
• Log poisoning: Injecting crafted values into headers that are logged can corrupt audit trails or introduce log-injection payloads
• Cache poisoning: In configurations with edge caches, injected headers may cause incorrect cache keying

The CVSS 9.1 score reflects the low attack complexity and absence of authentication requirements.

Affected Deployments

All Centrifugo deployments using versions prior to 6.9.0 that:

• Expose the WebSocket or HTTP-streaming endpoints to untrusted clients
• Use any server-side hooks or proxy forwarding that read headers from context

Deployments behind strict authentication gateways that validate all header values before they reach Centrifugo are at reduced (but not eliminated) risk.

Remediation

Upgrade to Centrifugo 6.9.0 or later. The fix sanitizes the ConnectRequest.headers map, ensuring client-supplied values cannot override or inject headers into the server's internal context.

Workarounds (if immediate upgrade is not possible)

1. Block untrusted WebSocket connections at the edge using a reverse proxy or WAF that validates or strips the protocol.ConnectRequest payload
2. Harden downstream middleware to never make authorization decisions solely on header values that could originate from clients
3. Audit proxy forwarding rules to ensure client-supplied header values are not forwarded to privileged backend services
4. Enable request logging to detect anomalous header values in ConnectRequest payloads

Detection Guidance

Monitor your Centrifugo logs and upstream service logs for:

• Unexpected header values in connection events — particularly headers that resemble internal/trust headers (X-Forwarded-For, X-Real-IP, X-User-*, Authorization, X-Internal-*)
• Authorization decisions that seem inconsistent with expected client access levels
• Unusual upstream requests originating from Centrifugo's proxy forwarding with unexpected header content

References

• NVD — CVE-2026-71485
• Centrifugo GitHub Repository
• Centrifugo 6.9.0 Release