CVE Intelligence
Analysis AI-assisted

CVE-2026-58172: Ocelot IP Allow/Block List Bypass via WebSocket Upgrade Requests

Ocelot through 24.1.0 contains an access control bypass that lets clients denied by IP-based rules reach downstream services by sending WebSocket upgrade requests. The record ties the issue to a MapWhen branch that omits SecurityMiddleware and cites fix commit f156fd4. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Ocelot through 24.1.0, fixed in commit f156fd4, lets clients that are denied by IP-based allow/block rules bypass those restrictions by sending WebSocket upgrade requests. The NVD record attributes this to a pipeline branch configured with MapWhen in OcelotPipelineExtensions.cs that does not include SecurityMiddleware.

Impact

  • Requests from blocked IP addresses can be forwarded to downstream services when they use the WebSocket upgrade path.
  • The record classifies the weakness as CWE-288, authentication bypass using an alternate path or channel.
  • The CNA scores are CVSS 3.1 9.1 (high confidentiality and integrity impact, no availability impact) and CVSS 4.0 9.3.

Affected products and versions

  • Ocelot through 24.1.0, according to the description.
  • The structured affected list in the record is empty, so exact version ranges cannot be confirmed from the available data.
  • The fix is referenced as commit f156fd4. The first released version containing it is not stated in the record.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00565 (percentile 0.45428), which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • Update Ocelot to a build that includes commit f156fd4 or a later release that contains it, after confirming the release in the project's changelog.
  • Until the update is applied, do not rely only on Ocelot IP allow/block rules to protect WebSocket routes. Apply network-layer restrictions in front of downstream services.
  • Review pipeline configuration for any MapWhen branches that handle upgrade requests and confirm they apply the same security middleware as the main pipeline.

Detection guidance

  • Review gateway and downstream logs for WebSocket upgrade requests originating from addresses on the block list.
  • Alert on successful upgrade responses for client IPs that were denied on normal HTTP routes.
  • Correlate gateway logs with downstream service logs to identify traffic that may have passed the gateway checks.

Limitations of the available information

  • The record has no structured affected or fixed version data.
  • The exact release containing the fix is not stated.
  • Related issue 2403 and pull request 2406 were identified but their content was not reviewed here.
  • Scores and EPSS values come from the record and may change over time.

Frequently asked questions

What is the core problem in this CVE?

Clients denied by IP-based allow/block rules can reach downstream services by sending WebSocket upgrade requests, because a MapWhen pipeline branch omits SecurityMiddleware.

Which versions are affected?

The description states Ocelot through 24.1.0. The structured affected list in the record is empty, so exact ranges cannot be confirmed from it.

Is there a fix?

The description references fix commit f156fd4. The record does not state the first released version that includes it, so check the project changelog before upgrading.

Is this being actively exploited?

The record shows no CISA KEV listing, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.