This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: CVE-2026-32301 is a critical SSRF flaw in **Centrifugo**. <br>๐ฅ **Consequences**: Attackers can trigger **Server-Side Request Forgery** via crafted JWTs.โฆ
๐ก๏ธ **Root Cause**: **CWE-918** (SSRF). <br>๐ **Flaw**: Improper configuration of the **dynamic JWKS endpoint URL**. The server fails to validate the source of the JWT signing keys, allowing malicious redirection. โ ๏ธ
Q3Who is affected? (Versions/Components)
๐ฆ **Affected**: **Centrifugo** (Real-time messaging server by Centrifugal Labs). <br>๐ **Version**: All versions **before 6.7.0**. <br>๐ข **Vendor**: Centrifugal Labs. ๐
Q4What can hackers do? (Privileges/Data)
๐ต๏ธ **Attacker Actions**: <br>1. **SSRF**: Force the server to request internal resources. <br>2. **Auth Bypass**: Exploit the JWT validation loop. <br>3.โฆ
๐ **Threshold**: **LOW**. <br>๐ **Auth**: **None required** (Unauthenticated). <br>โ๏ธ **Config**: Requires only the dynamic JWKS feature to be enabled. <br>๐ **Network**: Remote exploitation possible. ๐
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐งช **Public Exploit**: **No**. <br>๐ **PoC**: The provided data lists **empty** PoCs (`pocs: []`). <br>โ ๏ธ **Risk**: Despite no public code, the CVSS score indicates high exploitability. Be cautious! ๐
Q7How to self-check? (Features/Scanning)
๐ **Self-Check**: <br>1. Check Centrifugo version (`< 6.7.0`). <br>2. Audit config for **dynamic JWKS URL** settings. <br>3. Monitor logs for unusual JWT validation requests to internal IPs. ๐
Q8Is it fixed officially? (Patch/Mitigation)
โ **Fixed**: **Yes**. <br>๐ง **Patch**: Upgrade to **Centrifugo 6.7.0** or later. <br>๐ **Ref**: [GitHub Advisory GHSA-j77h-rr39-c552](https://github.com/centrifugal/centrifugo/security/advisories/GHSA-j77h-rr39-c552). ๐
Q9What if no patch? (Workaround)
๐ง **No Patch Workaround**: <br>1. **Disable** dynamic JWKS endpoints if not strictly needed. <br>2. **Whitelist** allowed JWKS URLs strictly. <br>3. Apply **WAF** rules to block SSRF patterns in JWT claims. ๐ก๏ธ
Q10Is it urgent? (Priority Suggestion)
๐ฅ **Urgency**: **HIGH**. <br>๐ **Priority**: **P1**. <br>๐ **CVSS**: High severity (C:H, S:C). <br>โณ **Action**: Patch immediately upon upgrade to v6.7.0. Do not ignore! โก