Incorrect Access Control in grpc-gateway by grpc-ecosystem
CVE-2026-37236
Currently unrated
What is CVE-2026-37236?
The grpc-gateway version 2.28.0 is susceptible to an Incorrect Access Control vulnerability, which occurs when the application processes the X-HTTP-Method-Override header without proper restrictions on the allowed methods. Specifically, this vulnerability allows an attacker to send a POST request with a Content-Type of application/x-www-form-urlencoded that includes the X-HTTP-Method-Override header. The application then rewrites the request method to an arbitrary value provided by the attacker before routing it. This exploitation can lead to the circumvention of method-based access controls that may have been enforced by upstream proxies or Web Application Firewalls (WAFs), posing significant risks to API security.