CVE-2026-32301

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32301", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-11T21:16:21.658Z", "datePublished": "2026-03-12T21:19:03.862Z", "dateUpdated": "2026-03-13T13:09:57.376Z"}, "containers": {"cna": {"title": "Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-j77h-rr39-c552", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-j77h-rr39-c552"}], "affected": [{"vendor": "centrifugal", "product": "centrifugo", "versions": [{"version": "< 6.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T21:19:03.862Z"}, "descriptions": [{"lang": "en", "value": "Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated attacker can craft a JWT with a malicious iss or aud claim value that gets interpolated into the JWKS fetch URL before the token signature is verified, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination. This vulnerability is fixed in 6.7.0."}], "source": {"advisory": "GHSA-j77h-rr39-c552", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T13:09:43.696846Z", "id": "CVE-2026-32301", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T13:09:57.376Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL", "source": {"advisory": "GHSA-j77h-rr39-c552", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "centrifugal", "product": "centrifugo", "versions": [{"status": "affected", "version": "< 6.7.0"}]}], "references": [{"url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-j77h-rr39-c552", "name": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-j77h-rr39-c552", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated attacker can craft a JWT with a malicious iss or aud claim value that gets interpolated into the JWKS fetch URL before the token signature is verified, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination. This vulnerability is fixed in 6.7.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-12T21:19:03.862Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32301", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T13:09:43.696846Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-13T13:09:53.246Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-32301", "state": "PUBLISHED", "dateUpdated": "2026-03-12T21:19:03.862Z", "dateReserved": "2026-03-11T21:16:21.658Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-12T21:19:03.862Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "centrifugo", "vendor": "centrifugal", "versions": [{"status": "affected", "version": "< 6.7.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:centrifugal:centrifugo:*:*:*:*:*:*:*:*", "matchCriteriaId": "FFE4B883-6865-417B-B19A-92020BB6F2BB", "versionEndExcluding": "6.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated attacker can craft a JWT with a malicious iss or aud claim value that gets interpolated into the JWKS fetch URL before the token signature is verified, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination. This vulnerability is fixed in 6.7.0."}, {"lang": "es", "value": "Centrifugo es un servidor de mensajer\u00eda en tiempo real escalable de c\u00f3digo abierto. Antes de la versi\u00f3n 6.7.0, Centrifugo es vulnerable a la falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) cuando se configura con una URL de endpoint JWKS din\u00e1mica utilizando variables de plantilla (p. ej., {{tenant}}). Un atacante no autenticado puede crear un JWT con un valor de reclamaci\u00f3n 'iss' o 'aud' malicioso que se interpola en la URL de obtenci\u00f3n de JWKS antes de que se verifique la firma del token, lo que hace que Centrifugo realice una petici\u00f3n HTTP saliente a un destino controlado por el atacante. Esta vulnerabilidad se corrige en la versi\u00f3n 6.7.0."}], "id": "CVE-2026-32301", "lastModified": "2026-06-17T10:35:31.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32301", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T13:09:43.696846Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:41.477", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-j77h-rr39-c552"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.7.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "centrifugo", "vendor": "centrifugal"}], "analysis": {"en": {"generated_at": "2026-03-18T20:06:40.309277+00:00", "value": {"mitigation_remediation": ["Upgrade Centrifugo to version 6.7.0 or later"], "summary": {"action": "Immediate Patch", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all Centrifugo installations from the vendor centrifugal that are running a version earlier than 6.7.0. Product identification is provided via the CPE string: cpe:2.3:a:centrifugal:centrifugo:*:*:*:*:*:*:*:*.", "description_and_impact": "Centrifugo is an open\u2011source real\u2011time messaging server that, prior to version 6.7.0, has a vulnerability allowing an unauthenticated attacker to trigger Server\u2011Side Request Forgery (SSRF). By injecting a malicious issuer (iss) or audience (aud) claim into a JWT, the attacker can cause the server to interpolate that claim into a dynamically configured JWKS endpoint URL before the token signature is verified. Consequently, Centrifugo will fetch the JWKS from an attacker\u2011controlled URL, resulting in arbitrary outbound HTTP requests from the server.", "risk_and_exploitability": "The flaw has a CVSS score of 9.3, categorized as critical. An EPSS score of less than 1% indicates low reported exploitation activity, and the vulnerability is not listed in the CISA KEV catalog. Attack can be performed without authentication and requires only outbound network connectivity from the affected server to an attacker\u2011controlled destination. The combination of high impact and low exploitability suggests that the risk is significant but may be mitigated by timely patching."}}}}, "created": "2026-03-13T09:49:44.618316+00:00", "updated": "2026-03-23T10:00:21.749840+00:00", "vendors": ["centrifugal", "centrifugal$PRODUCT$centrifugo"]}