CVE-2026-124278

Description

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type. Only the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another. This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.

References

• https://cna.erlef.org/cves/CVE-2026-124278.html
• https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292
• https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048
• https://github.com/elixir-grpc/grpc/commit/953ab980d8a127e895d3ab9505fc4b9337bb32f7
• https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xc5v-89vq-hv5m