by Kastro
Paper/Archive/CVE-2026-58172

CVE-2026-58172

ThreeMammals Ocelot — Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests

EPSS 0.6%public exploitCVSS 9.3
critical.is priorityof 100
47
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 46.9.469 × 209.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream services without enforcement of the configured allow/block list.

Affected

ProductAffectedFixed inSource
Ocelot≤ 24.1.0f156fd4017ca25025fffdad8ec56c1d657dfb402CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/ThreeMammals/Ocelot/issues/2403refgithub.com/ThreeMammals/Ocelot/pull/2406patchgithub.com/ThreeMammals/Ocelot/commit/f156fd4017ca25025fffdad8ec56c1d657dfb402writeupvulncheck.com/advisories/ocelot-ip-allow-block-list-bypass-for-websocket-upgrade-requests