CVE-2026-32301: SSRF in Centrifugo v6

The SSRF vulnerability in Centrifugo arises from improper handling of dynamic JWKS endpoint URLs using template variables within JWT verification. An attacker can craft a malicious JWT with carefully chosen iss or aud claims. These claims are interpolated into the JWKS fetch URL before the token signature is verified. This allows the attacker to control the destination of the HTTP request Centrifugo makes, potentially exposing internal resources or enabling unauthorized access to external services. The impact is severe, as an attacker can potentially read sensitive data, execute commands on internal systems, or pivot to other networks.

1. Reserved2026-03-11
2. Published2026-03-13
3. Modified2026-03-27
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-32301 is to upgrade Centrifugo to version 6.7.0 or later, which includes the fix. If upgrading immediately is not feasible, implement strict URL validation on the JWKS endpoint URL to prevent the interpolation of attacker-controlled values. This can be achieved by whitelisting allowed characters or using a more secure templating engine. Consider implementing a Web Application Firewall (WAF) with rules to block outbound requests to suspicious destinations. Regularly review and audit JWT configuration to ensure proper validation and prevent future SSRF vulnerabilities.