PT-2026-79145

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in...

CVE-2026-18972

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header "Grpc-Metadata-USER". This can lead to an account takeover attack from a user with low privileges to administrator...

CVE-2026-18972

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header "Grpc-Metadata-USER". This can lead to an account takeover attack from a user with low privileges to administrator...

EUVD-2026-56127

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header "Grpc-Metadata-USER". This can lead to an account takeover attack from a user with low privileges to administrator...

PT-2026-70179

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header "Grpc-Metadata-USER". This can lead to an account takeover attack from a user with low privileges to administrator...

GO-2024-2978 Private tokens could appear in logs if context containing gRPC metadata is logged in google.golang.org/grpc

If applications print or log a context containing gRPC metadata, the output will contain all the metadata, which may include private information. This represents a potential PII concern...

GHSA-XR7Q-JX4M-X55M Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go

Impact This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information. Patches The issue first appeared in 1.64.0 and is patched in 1.64.1 and...

Private tokens could appear in logs if context containing gRPC metadata is logged in github.com/grpc/grpc-go

Impact This issue represents a potential PII concern. If applications were printing or logging a context containing gRPC metadata, the affected versions will contain all the metadata, which may include private information. Patches The issue first appeared in 1.64.0 and is patched in 1.64.1 and...

Excessive Iteration in gRPC

gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow the following DOS attacks: - Unbounded memory buffering in the HPACK parser - Unbounded CPU consumption ...