CVE-2026-58172: Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests

Synopsis

This is a security control bypass vulnerability in Ocelot, the open-source .NET API gateway, affecting versions through 24.1.0. An unauthenticated attacker reachable over the network can send a WebSocket upgrade request to bypass IP-based allow/block list enforcement entirely, because the WebSocket pipeline branch omits the SecurityMiddleware that enforces those rules. Successful exploitation lets a blocked client reach downstream services as if the access restriction were never configured. A patched-image rebuild at commit f156fd4017ca25025fffdad8ec56c1d657dfb402 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Ocelot API gateway over the network to send a crafted WebSocket upgrade request.

• AuthenticationNot required

  No credentials or account of any kind are needed; the bypass is exploitable by any unauthenticated client.

• Victim interactionNot required

  No victim action is required; the attacker sends the malicious request directly without any user involvement.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors are needed to trigger the bypass.

Blast Radius

• The attacker reads responses from downstream services that the IP block list was intended to deny access to, including any data those services expose.
• The attacker sends arbitrary writes or mutations to downstream services, modifying application state, stored records, or configuration that those services accept from trusted callers.
• Any downstream service reachable through Ocelot's WebSocket routing is exposed, meaning the blast radius grows with the number of upstream services behind the gateway.