What is the CVSS score of CVE-2026-32301?

CVE-2026-32301 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-32301?

Yes, a public proof-of-concept exploit is available for CVE-2026-32301. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-32301?

Within 24 hours: Identify all Centrifugo instances in your environment and document their versions and JWKS configurations. Within 7 days: Implement compensating controls (disable dynamic JWKS endpoints if not essential, restrict outbound network access, deploy WAF rules to block malicious JWT claims). Within 30 days: Plan and execute upgrade to Centrifugo 6.7.0 or later, or migrate to alternative solutions if upgrade is not feasible.

Centrifugo CVE-2026-32301

Q: Which versions of Centrifugo are affected by CVE-2026-32301?

Centrifugo real-time messaging servers prior to version 6.7.0 contain a critical vulnerability allowing unauthenticated attackers to manipulate the server into making unauthorized network requests.. A patch is available.

EUVD-2026-11716 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-13 security-advisories@github.com

GHSA-j77h-rr39-c552

SSRF Centrifugo Suse Centrifugal

9.3

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft JWT with malicious iss/aud claim
Exploit

Centrifugo interpolates claim into JWKS URL template
Execution

Server makes HTTP request to attacker destination
Impact

Attacker receives internal network data

Vulnerability Assessment

Weakness	CWE CWE-918 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V4 - API and Web Service URL allowlisting, SSRF prevention MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Centrifugo configured with dynamic JWKS endpoint URL containing template variables (e.g., {{tenant}}, {{iss}}, {{aud}}). No authentication required. Affects all versions prior to 6.7.0 with this configuration.
Impact	CVSS 9.3.
Exploit ScenarioDerived	SSRF through messaging server.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 13, 2026

SSRF in Centrifugo real-time messaging before 6.7.0.

Earlier versions of this analysis (1)

v1 Mar 13, 2026 - 20:00 CVSS 9.3

SSRF in Centrifugo.

RemediationAI

Update.

Affected VersionsENISA

centrifugo < 6.7.0

Affected Packages

go github.com/centrifugal/centrifugo no fix

go github.com/centrifugal/centrifugo/v3 no fix

go github.com/centrifugal/centrifugo/v4 no fix

go github.com/centrifugal/centrifugo/v5 no fix

go github.com/centrifugal/centrifugo/v6 fix: 6.7.0

euvd centrifugo fix: 6.7.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 6 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-918.

Know when Centrifugo gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

SUSE CRITICAL

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 18, 2026 - 18:02 vuln.today

Public exploit code

CVE Published

Mar 13, 2026 - 19:54 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated attacker can craft a JWT with a malicious iss or aud claim value that gets interpolated into the JWKS fetch URL before the token signature is verified, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination. This vulnerability is fixed in 6.7.0.

Executive ViewAI

Why It Matters

Centrifugo real-time messaging servers prior to version 6.7.0 contain a critical vulnerability allowing unauthenticated attackers to manipulate the server into making unauthorized network requests. This poses a significant risk to organizations using affected versions, particularly those with dynamic JWKS endpoint configurations, though current real-world exploitation remains minimal.

Business Impact: High

Compensating Controls

Disable dynamic JWKS endpoint URL templates if business operations permit static configuration; implement strict network egress filtering to limit server-initiated outbound connections; deploy WAF rules to detect and block JWT claims with suspicious template injection patterns; restrict JWKS endpoint access to known, trusted sources via firewall rules; consider disabling Centrifugo's dynamic JWKS feature until patch is available; monitor outbound HTTP requests for anomalous activity.

Threat Intelligence Overview

EPSS Score

0.0%

Top 88% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Server-Side Request Forgery HIGH

Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.

More in Centrifugo

View all

CVE-2026-71485 CRITICAL Act Now

9.1 Aug 20

Authentication bypass in Centrifugo real-time messaging server before 6.9.0 lets a remote client spoof trusted proxy hea

CVE-2026-62963 HIGH This Week

8.7 Jul 16

Uncontrolled memory and CPU exhaustion in Centrifugo real-time messaging server before 6.8.4 lets unauthenticated attack

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all

CVE-2021-34473 CRITICAL POC

9.1

CVE-2021-26855 CRITICAL POC

9.1

CVE-2021-21985 CRITICAL POC

9.8

CVE-2022-41040 HIGH POC

8.8

CVE-2024-21893 HIGH POC

8.2

CVE-2021-40438 CRITICAL POC

9.0

CVE-2021-22054 HIGH POC

7.5

CVE-2021-21975 HIGH POC

7.5

Same technique SSRF

View all

CVE-2016-3718 MEDIUM POC

5.5

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

References

Advisories & patches

ADVISORY https://vuldb.com/?id.350812 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1135/ REF https://github.com/centrifugal/centrifugo/security/advisories/GHSA-j77h-rr39-c552

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back