PT-2026-53923 · Ocelot · Ocelot

George Chen · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-58172

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ocelot versions prior to 24.1.1

Description A security control bypass exists in the handling of WebSocket upgrade requests. The issue stems from a logic flaw in the MapWhen branch within OcelotPipelineExtensions.cs, which omits the SecurityMiddleware. This omission allows clients from blocked IP addresses to circumvent configured IP-based access restrictions. By sending a WebSocket upgrade request, an attacker can ensure their traffic is routed through the pipeline branch that skips IP restriction checks, enabling unauthorized proxying to downstream services.

Recommendations Update Ocelot to the version containing commit f156fd4.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-58172

Affected Products

Ocelot

References · 6

• 🔥 https://github.com/ThreeMammals/Ocelot/issues/2403 · Exploit
• https://github.com/ThreeMammals/Ocelot/commit/f156fd4017ca25025fffdad8ec56c1d657dfb402 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58172 · Security Note
• https://github.com/ThreeMammals/Ocelot/pull/2406 · Note
• https://vulncheck.com/advisories/ocelot-ip-allow-block-list-bypass-for-websocket-upgrade-requests · Note
• https://twitter.com/UpwindMDR/status/2072017681507569806 · Twitter Post