CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-58172 — Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypa...

·Source: NIST NVD

Updated:

Executive Summary

Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream servi

Analysis

Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability that allows denied clients to circumvent IP-based access restrictions by sending WebSocket upgrade requests. The WebSocket upgrade pipeline branch configured via MapWhen in OcelotPipelineExtensions.cs omits SecurityMiddleware, causing requests from blocked IP addresses to be proxied to downstream services without enforcement of the configured allow/block list. CVSS Score: 9.1. Published: 2026-06-30T17:16:24.313.

Indicators of Compromise (1)

CVE (1)
CVE-2026-58172
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 30, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Quantum Breakthroughs Compress Post-Quantum Computing Timeline

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/quantum-breakthroughs-compress-post-quantum-computing-timeline-image_small-2-a-32137.jpg" align=right hspace=4><b>Microsoft, Google and AWS cite major gains in reliability and error correction.</b><br>Rapid advances in quantum hardware, AI-assisted error correction and fault-tolerant architectures from Microsoft, Google and Amazon

Bank Info Security
MEDIUMVulnerability

US FTC Eyes AI Model Behavior in New Policy Push

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/us-ftc-eyes-ai-model-behavior-in-new-policy-push-image_small-1-a-32135.jpg" align=right hspace=4><b>Agency Seeks Comments on Objectivity, Accuracy and AI Governance</b><br>The FTC has opened a public comment period on whether AI companies improperly shape model behavior. The proposal could redefine how federal regulators oversee A

Bank Info Security
MEDIUMVulnerability

The Shadow AI Problem Starts in the C-Suite

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/shadow-ai-problem-starts-in-c-suite-image_small-9-a-32133.jpg" align=right hspace=4><b>Executives Are More Likely to Use Unapproved AI Tools Than Their Teams</b><br>Shadow AI may look like a rank-and-file problem, but new data suggests the biggest users of unauthorized tools are senior leaders and C-suite executives. The findings

Bank Info Security