CVE-2026-71485: CWE-290: Authentication Bypass by Spoofing in centrifugal centrifugo

The vulnerability occurs because centrifugal centrifugo's proxy configuration options `http_headers` and `grpc_metadata` forward headers from the client's connect request message rather than from genuine transport-level HTTP headers. Operators typically configure these options to forward trusted headers set by reverse proxies or API gateways. However, the client can supply arbitrary header values in the connect request, which centrifugo copies verbatim into an emulated headers context. These client-controlled headers are forwarded to backend services unless overridden by genuine HTTP headers, which do not exist for the unidirectional gRPC transport. This allows attackers to spoof any header the backend trusts for authentication or authorization, enabling full identity impersonation without credentials. The issue was confirmed in centrifugo version 6.8.3 and affects all versions prior to 6.9.0.

Attackers can fully spoof any header trusted by the backend for authentication or authorization, leading to potential full account or identity impersonation. This bypass requires no credentials, JWTs, or API keys and affects all proxy call types for the entire connection lifetime. The backend may grant unauthorized access or privileges based on the spoofed headers.

No official patch or fix is currently documented. Operators should be aware that `http_headers` and `grpc_metadata` proxy options can be supplied by clients and are not guaranteed to originate from trusted reverse proxies. It is recommended to avoid relying on client-supplied headers for authentication or authorization decisions. The vendor suggests documenting this behavior explicitly and providing a separate allowlist for headers sourced only from genuine transport-level HTTP headers. For the unidirectional gRPC transport, consider disabling `http_headers` forwarding entirely. Monitor the vendor advisory for updates and official fixes.