CVE-2026-32301 PUBLISHED CVSS 9.300000190734863 CRITICAL

Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL

EPSS 0.07% · 21.4th percentile

Risk Scores

CVSS v3.1
9.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
EPSS Score
0.07%
21.4th percentile

Affected Products

VendorProductVersions
github.comcentrifugal/centrifugo0, 0
github.comcentrifugal/centrifugo/v50, 0
github.comcentrifugal/centrifugo/v60, 0
github.comcentrifugal/centrifugo/v30, 0
github.comcentrifugal/centrifugo/v40, 0
centrifugalcentrifugo0, < 6.7.0, < 6.7.0

Timeline

References

Open in Interactive Console →