github.com/centrifugal/centrifugo vulnerabilities (Go)

5 vulnerabilities.

• github.com/centrifugal/centrifugo Go Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends CVE-2026-71485 Fix available 9.1 CriticalAugust 20, 2026
• github.com/centrifugal/centrifugo Go Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass CVE-2026-49998 Fix available 8.2 HighJuly 1, 2026
• github.com/centrifugal/centrifugo Go Centrifugo's InsecureSkipTokenSignatureVerify flag silently disables JWT verification with no warning GHSA-q926-c743-49qj Fix available 0.0 NoneMarch 13, 2026
• github.com/centrifugal/centrifugo Go Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL CVE-2026-32301 Fix available 9.3 CriticalMarch 12, 2026
• github.com/centrifugal/centrifugo Go Centrifugo v6.6.0 dependency vulnerabilities GHSA-j9wf-6r2x-hqmx Fix available No scoreFebruary 19, 2026