CVE-2026-32301: Centrifugo SSRF Vulnerability via JWKS

CVE-2026-32301 Overview

CVE-2026-32301 is a Server-Side Request Forgery (SSRF) vulnerability affecting Centrifugo, an open-source scalable real-time messaging server. The vulnerability exists in versions prior to 6.7.0 when the server is configured with a dynamic JWKS (JSON Web Key Set) endpoint URL using template variables such as {{tenant}}. An unauthenticated attacker can craft a malicious JWT with specially crafted iss (issuer) or aud (audience) claim values that get interpolated into the JWKS fetch URL before the token signature is verified, causing Centrifugo to make outbound HTTP requests to attacker-controlled destinations.

Critical Impact
This SSRF vulnerability allows unauthenticated attackers to force Centrifugo servers to make arbitrary outbound HTTP requests, potentially enabling access to internal services, cloud metadata endpoints, and sensitive internal network resources.

Affected Products

Centrifugal Centrifugo versions prior to 6.7.0
Centrifugo deployments using dynamic JWKS endpoint configuration with template variables
Environments utilizing JWT authentication with multi-tenant JWKS configurations

Discovery Timeline

2026-03-13 - CVE-2026-32301 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-32301

Vulnerability Analysis

The vulnerability stems from improper handling of JWT claims during the JWKS endpoint URL construction process. When Centrifugo is configured to use dynamic JWKS endpoints with template variables (e.g., https://auth.example.com/{{tenant}}/.well-known/jwks.json), the server interpolates user-controlled JWT claim values into the URL path before verifying the token's cryptographic signature.

This creates a pre-authentication SSRF condition where an attacker can submit a crafted JWT containing malicious values in the iss or aud claims. Since these claims are processed and interpolated into the JWKS fetch URL before any signature validation occurs, the attacker can direct Centrifugo to make HTTP requests to arbitrary destinations, including internal network resources, cloud metadata services, or other sensitive endpoints.

Root Cause

The root cause is a CWE-918 (Server-Side Request Forgery) vulnerability resulting from insufficient validation and sanitization of JWT claim values before they are used in URL construction. The template variable interpolation mechanism trusts user-supplied JWT claims without proper bounds checking or URL validation, allowing attackers to inject arbitrary URL components that redirect the JWKS fetch request.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker constructs a JWT with a malicious iss or aud claim containing a URL pointing to an attacker-controlled server or an internal resource. When Centrifugo receives this JWT and attempts to fetch the corresponding JWKS for signature verification, it first interpolates the malicious claim into the URL template, resulting in an outbound request to the attacker-specified destination.

For example, if Centrifugo is configured with a JWKS URL template like https://auth.example.com/{{tenant}}/.well-known/jwks.json, an attacker could craft a JWT where the tenant claim resolves to something like ../../attacker.com/malicious, potentially redirecting the JWKS fetch to an unintended destination. The vulnerability allows attackers to probe internal networks, access cloud metadata endpoints (such as 169.254.169.254), or exfiltrate sensitive data through DNS or HTTP requests to controlled servers.

Detection Methods for CVE-2026-32301

Indicators of Compromise

Unusual outbound HTTP requests from Centrifugo servers to internal IP addresses or cloud metadata endpoints
JWT tokens containing suspicious or malformed iss or aud claim values with URL-like patterns or path traversal sequences
Network traffic from Centrifugo to unexpected external destinations during JWT authentication attempts
Log entries showing JWKS fetch failures to unusual or internal URLs

Detection Strategies

Monitor Centrifugo logs for JWKS fetch requests to non-standard or internal IP addresses
Implement network-level monitoring to detect outbound requests from Centrifugo to internal networks or cloud metadata services
Deploy Web Application Firewall (WAF) rules to inspect JWT tokens for suspicious claim patterns
Use SIEM correlation rules to identify anomalous authentication patterns involving unusual JWKS endpoints

Monitoring Recommendations

Enable verbose logging for JWT authentication and JWKS fetching operations in Centrifugo
Configure network monitoring to alert on outbound connections from Centrifugo to RFC 1918 addresses or cloud metadata IPs
Implement egress filtering to restrict Centrifugo's ability to make outbound HTTP requests to untrusted destinations
Review authentication logs regularly for patterns indicating SSRF exploitation attempts

How to Mitigate CVE-2026-32301

Immediate Actions Required

Upgrade Centrifugo to version 6.7.0 or later immediately
Audit current JWKS endpoint configurations for use of template variables that may be vulnerable
Implement network-level egress controls to restrict outbound HTTP requests from Centrifugo servers
Review logs for any evidence of exploitation attempts prior to patching

Patch Information

The vulnerability is fixed in Centrifugo version 6.7.0. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-j77h-rr39-c552.

Workarounds

If upgrading immediately is not possible, consider disabling dynamic JWKS endpoint configurations that use template variables
Implement strict network egress filtering to prevent Centrifugo from making outbound requests to internal networks or sensitive endpoints
Use a static JWKS endpoint configuration instead of dynamic template-based URLs until the patch can be applied
Deploy a reverse proxy in front of Centrifugo that validates JWT claims before forwarding requests

bash

# Example network egress restriction using iptables
# Block outbound connections from Centrifugo to internal networks and cloud metadata
iptables -A OUTPUT -m owner --uid-owner centrifugo -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner centrifugo -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner centrifugo -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner centrifugo -d 192.168.0.0/16 -j DROP