CVE-2026-71485

Centrifugo 6.9.0 patches a header spoofing vulnerability (CVE-2026-71485, CVSS 9.1) where the OnClientConnecting hook allows client-controlled data to be treated as server-authoritative after passing through ConnectEvent.Headers and SetEmulatedHeadersToContext. The fix adds allowlisting controls to prevent arbitrary header injection through HTTP and gRPC proxy paths. However, there's strong evidence this addresses specific code paths rather than the architectural pattern — and the unidirectional gRPC transport explicitly cannot be patched at the transport layer, meaning deployments relying on it may remain vulnerable regardless of version number. Start by determining your transport configuration. If you're using unidirectional gRPC as your primary transport, the 6.9.0 upgrade provides no protection for this vector — the fix simply doesn't reach that code path. This isn't a newly discovered limitation; the unidirectional transport predates the security hardening applied to bidirectional paths and appears to represent deprecated architecture that was never refactored. You need to evaluate whether migration to bidirectional gRPC or HTTP is feasible. Second, audit your backend authentication immediately. The vulnerability's real severity isn't the CVSS score — it's whether your backends rely on forwarded headers like x-trusted-user as the primary trust signal for authorization. If a backend accepts these headers as server-authoritative without additional verification, compromising them through Centrifugo's proxy gives you lateral movement across your entire microservices topology, not just a single service. Third, verify your OnClientConnecting integrations didn't silently break. If you were using this hook to populate ConnectEvent.Headers for downstream auth — and the API naming made this feel like the intended usage — 6.9.0 may have removed that capability without warning. Check whether your integrations are functioning as expected post-upgrade, and be aware that the fix may have created a false sense of security: the version bump exists, but your specific transport configuration may not be protected. Finally, recognize that even if 6.9.0 fully patches the allowlisting paths, the underlying architectural debt remains. Backends that were built around x-trusted-user as a trust anchor are running compromised trust models. The patch removes one exploitation vector without restructuring how your operators handle authentication context. Your remediation extends beyond the version bump to include auditing every backend that treats forwarded headers as server-authoritative and redesigning those integrations to carry explicit provenance signals.

Reviewed through automated stages and approved by a human before publication.