Centrifugo

v6.9.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 14d Developer Productivity

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ably alternative eventsource grpc http-streaming http3

+13 more

messaging pubnub pusher real-time redis scalability server-sent-events socket-io sse streaming websocket websockets webtransport

Affected surfaces

auth

ReleasePort's take

Moderate signal

editorial:auto 13d

Centrifugo v6.9.1 deprecates and then removes the undocumented admin authentication token fallback via the `token` query parameter, enforcing use of the Authorization header.

Why it matters: Security severity 80; admins must update authentication flows before removal to avoid access failures.

Summary

AI summary

Updates Miscellaneous, https://github.com/centrifugal/centrifugo/commit/3fc933d9, and https://github.com/centrifugal/centrifugo/pull/1184 across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	High	Deprecates undocumented admin auth token fallback via `token` query parameter. Deprecates undocumented admin auth token fallback via `token` query parameter. Source: llm_adapter@2026-07-13 Confidence: low	—
Security	High	Removes undocumented fallback reading admin auth token from `token` query parameter; requires Authorization header. Removes undocumented fallback reading admin auth token from `token` query parameter; requires Authorization header. Source: granite4.1:30b@2026-07-14-audit Confidence: low	—
Feature	Low	Adds ability to choose color accents in admin web UI. Adds ability to choose color accents in admin web UI. Source: llm_adapter@2026-07-13 Confidence: high	—
Dependency	Low	Built with Go 1.26.5. Built with Go 1.26.5. Source: llm_adapter@2026-07-13 Confidence: high	—
Deprecation	Low	Removes the unused `ordered` option from map commands. Removes the unused `ordered` option from map commands. Source: llm_adapter@2026-07-13 Confidence: high	—
Bugfix	Medium	Fixes a WARN log about missing `dev` key on start. Fixes a WARN log about missing `dev` key on start. Source: llm_adapter@2026-07-13 Confidence: high	—
Bugfix	Medium	Adds previously missing API commands (map, shared poll) to admin web UI. Adds previously missing API commands (map, shared poll) to admin web UI. Source: llm_adapter@2026-07-13 Confidence: high	—

Full changelog

Centrifugo is an open-source scalable real-time messaging server. It instantly delivers messages to application online users connected over supported transports (WebSocket, HTTP-streaming, Server-Sent Events (SSE), GRPC, WebTransport). Centrifugo is built around channel subscriptions – so it's a user-facing PUB/SUB server.

Centrifugo is language-agnostic and can be used to build chat apps, live comments, multiplayer games, real-time data visualizations, collaborative tools, AI streaming responses, etc. in combination with any backend. It is well suited for modern architectures and allows decoupling the business logic from the real-time transport layer.

Official client SDKs are available for JavaScript (browser, Node.js, React Native), Dart/Flutter, Swift, Java, Python, Go, and .NET. In addition, Centrifugo supports a unidirectional approach for simple use cases with no SDK dependency.

For details, go to the Centrifugo documentation site. For runnable demos see centrifugal/examples.

What's changed

Improvements

Possibility to choose color accents in admin web UI.

Fixes

Admin web UI: add previously missing API commands to the web UI – map API (map_publish, map_remove, map_read_state, map_read_stream, map_stats, map_clear), shared poll API, etc. – and update the embedded web UI (#1184, commit 3fc933d9).
Fix a WARN log about a missing dev key on start – some options and flags left over from the dev page removed in v6.9.0 were not fully cleaned up (#1185, commit 8cee857f).
Admin: drop the undocumented and unused fallback that read the admin auth token from a token URL query parameter – the token must be supplied via the Authorization header (#1187, commit bc33546f). Addresses GHSA-v4h4-9j4c-ghgp
Removed an unused map ordered option (#1186, commit 8752f242).

Miscellaneous

Docs: expanded the load balancing chapter with configs for Envoy, Caddy, and Traefik (in addition to Nginx and HAProxy) – all validated in a playground running two nodes behind each proxy across every transport (WebSocket, HTTP streaming, SSE) over plaintext and TLS, up to 10k connections.
Docs: added interactive widgets throughout the documentation to clarify concepts where newcomers get confused most – for example the connection JWT explorer, subscription JWT explorer, channel resolver, subscribe permission model, and interactive proxy explorer.
This release is built with Go 1.26.5
Dependency updates
See also the corresponding Centrifugo PRO release.

Breaking Changes

Removed the unused `ordered` option from map configuration.

Security Fixes

GHSA-v4h4-9j4c-ghgp – Admin web UI drops undocumented fallback that accepted admin auth token via `token` URL query parameter; token must now be supplied in the `Authorization` header.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Centrifugo

Get notified when new releases ship.

About Centrifugo

Language-agnostic real-time messaging (Websocket or SockJS) server.

All releases →