CVE-2026-124278
HIGHAttack Surface
CVSS Vector Breakdown
Description
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type. Only the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another. This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.
Affected Software (4)
| Vendor | Product | Version |
|---|---|---|
| elixir-grpc | grpc | 0.8.0 < 1.0.0 |
| elixir-grpc | grpc | 8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048 < 0332faae5f5e132314794dbfdae5edecbccea292 |
| elixir-grpc | grpc_server | 1.0.0 < 1.1.0 |
| elixir-grpc | grpc_server | 0332faae5f5e132314794dbfdae5edecbccea292 < 953ab980d8a127e895d3ab9505fc4b9337bb32f7 |