Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Check Centrifugo version (`< 6.7.0`). 2. Audit config for **dynamic JWKS URL** settings. 3. Monitor logs for unusual JWT validation requests to internal IPs. 📊

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: **Yes**. 🔧 **Patch**: Upgrade to **Centrifugo 6.7.0** or later. 🔗 **Ref**: [GitHub Advisory GHSA-j77h-rr39-c552](https://github.com/centrifugal/centrifugo/security/advisories/GHSA-j77h-rr39-c552). 📄

Q: What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1. **Disable** dynamic JWKS endpoints if not strictly needed. 2. **Whitelist** allowed JWKS URLs strictly. 3. Apply **WAF** rules to block SSRF patterns in JWT claims. 🛡️

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. 📈 **Priority**: **P1**. 📉 **CVSS**: High severity (C:H, S:C). ⏳ **Action**: Patch immediately upon upgrade to v6.7.0. Do not ignore! ⚡

Question 1

What is this vulnerability? (Essence + Consequences)

Accepted Answer

🚨 **Essence**: CVE-2026-32301 is a critical SSRF flaw in **Centrifugo**.
💥 **Consequences**: Attackers can trigger **Server-Side Request Forgery** via crafted JWTs.…

Question 2

Root Cause? (CWE/Flaw)

Accepted Answer

🛡️ **Root Cause**: **CWE-918** (SSRF).
🔍 **Flaw**: Improper configuration of the **dynamic JWKS endpoint URL**. The server fails to validate the source of the JWT signing keys, allowing malicious redirection. ⚠️

Question 3

Who is affected? (Versions/Components)

Accepted Answer

📦 **Affected**: **Centrifugo** (Real-time messaging server by Centrifugal Labs).
📅 **Version**: All versions **before 6.7.0**.
🏢 **Vendor**: Centrifugal Labs. 📌

Question 4

What can hackers do? (Privileges/Data)

Accepted Answer

🕵️ **Attacker Actions**:
1. **SSRF**: Force the server to request internal resources.
2. **Auth Bypass**: Exploit the JWT validation loop.
3.…

Question 5

Is exploitation threshold high? (Auth/Config)

Accepted Answer

🔓 **Threshold**: **LOW**.
🔑 **Auth**: **None required** (Unauthenticated).
⚙️ **Config**: Requires only the dynamic JWKS feature to be enabled.
🌐 **Network**: Remote exploitation possible. 🚀

Question 6

Is there a public Exp? (PoC/Wild Exploitation)

Accepted Answer

🧪 **Public Exploit**: **No**.
📝 **PoC**: The provided data lists **empty** PoCs (`pocs: []`).
⚠️ **Risk**: Despite no public code, the CVSS score indicates high exploitability. Be cautious! 🛑

Question 7

How to self-check? (Features/Scanning)

Accepted Answer

🔍 **Self-Check**:
1. Check Centrifugo version (`< 6.7.0`).
2. Audit config for **dynamic JWKS URL** settings.
3. Monitor logs for unusual JWT validation requests to internal IPs. 📊

Question 8

Is it fixed officially? (Patch/Mitigation)

Accepted Answer

✅ **Fixed**: **Yes**.
🔧 **Patch**: Upgrade to **Centrifugo 6.7.0** or later.
🔗 **Ref**: [GitHub Advisory GHSA-j77h-rr39-c552](https://github.com/centrifugal/centrifugo/security/advisories/GHSA-j77h-rr39-c552). 📄

Question 9

What if no patch? (Workaround)

Accepted Answer

🚧 **No Patch Workaround**:
1. **Disable** dynamic JWKS endpoints if not strictly needed.
2. **Whitelist** allowed JWKS URLs strictly.
3. Apply **WAF** rules to block SSRF patterns in JWT claims. 🛡️

Question 10

Is it urgent? (Priority Suggestion)

Accepted Answer

🔥 **Urgency**: **HIGH**.
📈 **Priority**: **P1**.
📉 **CVSS**: High severity (C:H, S:C).
⏳ **Action**: Patch immediately upon upgrade to v6.7.0. Do not ignore! ⚡

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-32301 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

Q2Root Cause? (CWE/Flaw)

Q3Who is affected? (Versions/Components)

Q4What can hackers do? (Privileges/Data)

Q5Is exploitation threshold high? (Auth/Config)

Q6Is there a public Exp? (PoC/Wild Exploitation)

Q7How to self-check? (Features/Scanning)

Q8Is it fixed officially? (Patch/Mitigation)

Q9What if no patch? (Workaround)

Q10Is it urgent? (Priority Suggestion)

Continue exploring