CVE-2026-124278

Name of the Vulnerable Software and Affected Versions grpc server versions 1.0.0 through 1.0.9 grpc versions 0.8.0 through 0.9.9

Description An authorization bypass occurs when a handler acts on a resource different from the one specified in the URL of an HTTP-transcoded route. This happens because the GRPC.Server.do handle request/4 function only applies route path bindings to the request message during HTTP transcoding. If a request is sent with a Content-Type of application/grpc or application/grpc-web, the system decodes the message from the body alone, ignoring the path bindings. Consequently, a security gateway or WAF authorizing the request based on the URL path may see one resource, while the handler processes another based on the body content. This allows an attacker to potentially access or modify resources belonging to other users or tenants.

Recommendations Update grpc server to version 1.1.0 or later. Update grpc to version 1.0.0 or later.