CVE-2026-37236

Name of the Vulnerable Software and Affected Versions grpc-gateway version 2.28.0

Description Incorrect Access Control occurs because the application processes the X-HTTP-Method-Override header in the ServeMux.ServeHTTP() function without restricting allowed methods. When a POST request with Content-Type set to application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary value provided by the attacker before routing. This behavior enables the bypass of method-based access controls enforced by Web Application Firewalls (WAFs) or upstream proxies.

Recommendations Update grpc-gateway version 2.28.0 to a newer version that contains a fix for this issue. As a temporary mitigation, restrict or filter the X-HTTP-Method-Override header at the proxy or WAF level before it reaches the application.