Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL

The SSRF vulnerability in Centrifugo arises from improper handling of dynamic JWKS endpoint URLs using template variables within JWT verification. An attacker can craft a malicious JWT with carefully chosen iss or aud claims. These claims are interpolated into the JWKS fetch URL before the token signature is verified. This allows the attacker to control the destination of the HTTP request Centrifugo makes, potentially exposing internal resources or enabling unauthorized access to external services. The impact is severe, as an attacker can potentially read sensitive data, execute commands on internal systems, or pivot to other networks.

Organizations utilizing Centrifugo v6 for real-time messaging, particularly those with dynamic JWKS endpoint configurations or those exposing Centrifugo to untrusted networks, are at significant risk. Shared hosting environments where Centrifugo instances are deployed alongside other applications are also vulnerable.

• linux / server:

journalctl -u centrifugo | grep -i "request to" && journalctl -u centrifugo | grep -i "jwks"

• generic web:

curl -I <centrifugo_endpoint>/connect | grep -i "Location:"

• generic web: Inspect Centrifugo configuration files for dynamic JWKS endpoint URLs using template variables (e.g., {{tenant}}).

1. 2026-03-13Disclosure

   disclosure

1. Reserviert2026-03-11
2. Veröffentlicht2026-03-13
3. Geändert2026-03-27
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-32301 is to upgrade Centrifugo to version 6.7.0 or later, which includes the fix. If upgrading immediately is not feasible, implement strict URL validation on the JWKS endpoint URL to prevent the interpolation of attacker-controlled values. This can be achieved by whitelisting allowed characters or using a more secure templating engine. Consider implementing a Web Application Firewall (WAF) with rules to block outbound requests to suspicious destinations. Regularly review and audit JWT configuration to ensure proper validation and prevent future SSRF vulnerabilities.