CVE-2026-58172

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58172
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58172.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-58172
Published
2026-06-30T15:54:59.466Z
Modified
2026-07-16T03:31:02.169314775Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests
Details

Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream services without enforcement of the configured allow/block list.

Database specific 
{
    "cwe_ids": [
        "CWE-288"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58172.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/threemammals/ocelot

Affected ranges

Type
GIT
Repo
https://github.com/threemammals/ocelot
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9fc4e78d314ad97d836b35c9b9bb188dba49d556
Fixed
f156fd4017ca25025fffdad8ec56c1d657dfb402
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "24.1.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.2.0
1.2.0-unstable
1.3.0
1.3.0-unstable
1.3.2
1.4.0
1.4.1
1.4.10
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
10.*
10.0.0
10.0.1
10.0.2
10.0.3
10.0.4
11.*
11.0.0
11.0.1
11.0.2
11.0.3
12.*
12.0.0
12.0.1
13.*
13.0.0
13.3.0
13.4.0
13.4.1
13.5.0
13.5.2
13.8.0
13.8.1
13.8.2
13.8.3
13.8.4
13.8.5
14.*
14.0.0
14.0.1
14.0.10
14.0.11
14.0.12
14.0.2
14.0.3
14.0.4
14.0.5
14.0.6
14.0.7
14.0.8
14.0.9
14.1.0
14.1.1
14.1.2
14.1.3
15.*
15.0.0
15.0.1
15.0.2
15.0.3
15.0.4
15.0.5
15.0.6
15.0.7
16.*
16.0.0
16.0.1
17.*
17.0.1
18.*
18.0.0
19.*
19.0.0
19.0.1
19.0.2
19.0.3
2.*
2.0.0
2.0.1
2.0.10
2.0.11
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
20.*
20.0.0
20.0.1
21.*
21.0.0
22.*
22.0.0
22.0.1
23.*
23.0.0
23.1.0
23.2.0
23.2.1
23.2.2
23.3.0
23.3.4
23.3.5
23.3.6
23.4.0
23.4.1
23.4.2
24.*
24.0.0
24.1.0
25.*
25.0.0-beta.1
25.0.0-beta.2
25.0.0-beta.3
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
4.*
4.0.0
5.*
5.0.0
5.0.1
5.1.0
5.2.0
5.3.0
5.3.1
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
6.*
6.0.0
7.*
7.0.0
7.0.1
7.0.2
7.0.2.1
7.0.3
7.0.4
7.0.5
7.0.6+9.build.1253
7.0.7
7.0.8
7.0.9
8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8
9.*
9.0.0
oa24.*
oa24.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58172.json"