Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in internal/proxy/http.go, the requestMetadata path in internal/proxy/grpc.go, and the Consume path in internal/unigrpc/grpc.go can forward an allowlisted value as a trusted backend header or metadata value. A remote client can spoof a header such as x-trusted-user for connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The unidirectional gRPC transport has no transport-level HTTP header that can override the emulated value. This issue is fixed in version 6.9.0.

CVE-2026-71485 affects Centrifugo, an open-source scalable real-time messaging server, in versions prior to 6.9.0. The vulnerability allows remote clients to spoof trusted headers such as x-trusted-user by injecting values through the client-controlled protocol.ConnectRequest.headers map. These spoofed headers are propagated through multiple internal paths including HTTP proxy, gRPC proxy, and unidirectional gRPC transport. The flaw can be exploited during connect, refresh, subscribe, publish, RPC, and related proxy calls when backend systems rely on these headers for authentication or authorization decisions. The unidirectional gRPC transport is particularly affected as it has no transport-level HTTP header to override the emulated value. This represents a significant authentication bypass risk for deployments relying on header-based trust models. The issue has been patched in Centrifugo version 6.9.0.