Authorization Bypass in elixir-grpc gRPC Server and Client

CVE-2026-124278

What is CVE-2026-124278?

A vulnerability exists in the elixir-grpc gRPC Server and Client that allows an attacker to bypass authorization mechanisms. By manipulating the HTTP-transcoded route, an unauthorized party can make requests that interact with resources not intended for their access. The security flaw arises from the way path bindings are handled in requests with gRPC Content-Types, where authorization checks may rely on the URL path while the handler processes a different resource based on the request body. This discrepancy can lead to potential unauthorized actions on resources, underscoring the need for proper validation and handling of gRPC requests.

References