CVE-2026-58172 Details
Description
Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream services without enforcement of the configured allow/block list.
A security control bypass vulnerability has been identified in Ocelot versions through 24.1.0. This vulnerability allows clients with denied IP addresses to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The issue arises because the WebSocket upgrade pipeline, configured via 'MapWhen' in 'OcelotPipelineExtensions.cs', excludes 'SecurityMiddleware'. As a result, requests from blocked IP addresses are proxied to downstream services without enforcing the configured allow/block list. This flaw enables unauthorized access to services that are supposed to be protected by IP restrictions.
Users can update to Ocelot version 25.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ThreeMammals/Ocelot/commit/f156fd4017ca25025fffdad8ec56c1d657dfb402 | [email protected] | Source CodeVendor |
| https://github.com/ThreeMammals/Ocelot/issues/2403 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/ThreeMammals/Ocelot/pull/2406 | [email protected] | Issue TrackingVendor |
| https://www.vulncheck.com/advisories/ocelot-ip-allow-block-list-bypass-for-websocket-upgrade-requests | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ThreeMammals Ocelot | <= 24.1.0 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |