Which versions of Ocelot are affected by CVE-2026-58172?

Ocelot API Gateway deployments (versions through 24.1.0) are vulnerable to an access control bypass that allows attackers to reach protected backend systems by circumventing configured network access…. A patch is available.

Is there a public PoC exploit available for CVE-2026-58172?

Yes, a public proof-of-concept exploit is available for CVE-2026-58172. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-58172?

Within 24 hours: (1) Identify all production and non-production Ocelot instances running version 24.1.0 or earlier; (2) audit access logs for WebSocket upgrade (GET with 'Upgrade: websocket' header) requests to protected services; (3) catalog downstream systems relying solely on IP-based access control. Within 7 days: apply vendor-released patch to upgrade all affected Ocelot instances. Within 30 days: implement application-layer authentication as the primary control for protected services, with IP restrictions as secondary defense, and validate security middleware is invoked for all request types.

Ocelot CVE-2026-58172

Q: What is the CVSS score of CVE-2026-58172?

CVE-2026-58172 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40353 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-30 VulnCheck

GHSA-wc9q-87f2-4983

Authentication Bypass Ocelot

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Unauthenticated remote bypass triggered by simply using a WebSocket upgrade (PR:N, AC:L, AV:N); exposes downstream confidentiality and integrity (C:H/I:H), with availability unaffected (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 30, 2026 - 17:30 vuln.today

Analysis Updated

Jun 30, 2026 - 17:30 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 17:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 17:22 NVD

9.1 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Jun 30, 2026 - 17:18 vuln.today

DescriptionCVE.org

Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream services without enforcement of the configured allow/block list.

AnalysisAI

IP-based access control bypass in ThreeMammals Ocelot (a .NET API Gateway) through 24.1.0 lets denied or non-allowlisted clients reach protected downstream services by sending a WebSocket upgrade request instead of a plain HTTP request. The WebSocket pipeline branch, split off via MapWhen in OcelotPipelineExtensions.cs, never invokes SecurityMiddleware, so the configured IPAllowedList/IPBlockedList is silently skipped for upgrade traffic. Publicly available exploit code exists (VulnCheck advisory plus a reproducer in PR #2406), though there is no public exploit identified as actively exploited at time of analysis.

Technical ContextAI

Ocelot is a widely used open-source API gateway/reverse proxy for ASP.NET Core microservice deployments (CPE cpe:2.3:a:threemammals:ocelot). Its request pipeline is assembled in OcelotPipelineExtensions.cs, where an ASP.NET Core MapWhen predicate diverts WebSocket upgrade requests into a separate proxying branch. That branch was constructed without registering SecurityMiddleware - the component responsible for evaluating per-route and global SecurityOptions (IPAllowedList / IPBlockedList). The root cause maps to CWE-288 (Authentication/Access Control Bypass Using an Alternate Path or Channel): the same logical resource is reachable through two pipeline paths, only one of which enforces the security control. The vendor PR also corrects the rejection status to HTTP 403 Forbidden and adds acceptance tests (WebSocketsSecurityTests) asserting that blocked IPs are denied on upgrade.

RemediationAI

Upgrade to the Ocelot release that includes commit f156fd4 (PR #2406), which adds SecurityMiddleware to the WebSocket upgrade pipeline branch; the fix is confirmed by the vendor commit and acceptance tests, though a specific tagged NuGet release number was not provided in the input - verify the next published version above 24.1.0 against the commit before deploying. As a compensating control until patched, enforce the IP allow/block policy outside Ocelot - at an upstream reverse proxy, load balancer, WAF, or host firewall - so the restriction applies regardless of HTTP vs WebSocket framing; the trade-off is added operational complexity and the need to keep two policy sources in sync. If WebSocket routing is not required, disabling WebSocket-scheme routes (ws/wss) removes the vulnerable branch entirely at the cost of breaking any real-time downstream features. Relevant URLs: PR https://github.com/ThreeMammals/Ocelot/pull/2406, commit https://github.com/ThreeMammals/Ocelot/commit/f156fd4017ca25025fffdad8ec56c1d657dfb402, advisory https://www.vulncheck.com/advisories/ocelot-ip-allow-block-list-bypass-for-websocket-upgrade-requests.