CVE-2026-101916 in grpc-js
Summary
by MITRE • 09/28/2026
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified within the @grpc/grpc-js library represents a critical flaw in the handling of Transport Layer Security (TLS) peer certificate validation, specifically affecting versions prior to 1.13.6 and 1.14.5. This JavaScript implementation of gRPC core functionality is designed to operate without reliance on C++ addons, relying entirely on native Node.js TLS capabilities for security operations. The specific defect resides in the getAuthContext method, which is responsible for retrieving authentication context information from established connections. In affected versions, this function fails to properly distinguish between authorized and unauthorized peer certificates when the server credentials are configured with requireClientCertificate set to false. This configuration typically implies that client certificate verification is not mandatory for establishing a connection, but it does not necessarily imply that all presented certificates should be treated as valid or trusted if they fail validation checks during the handshake process.
The technical root cause of this vulnerability lies in the logic flow within the authentication context retrieval mechanism. When requireClientCertificate is disabled, the server allows connections without presenting a client certificate. However, if a client does present a certificate that fails verification due to being untrusted or expired, the library incorrectly processes this state as an authorized connection rather than rejecting it or flagging it appropriately. This logic error results in the getAuthContext method returning authentication context data that indicates successful authorization for peers whose certificates were actually unauthorized. Consequently, applications relying on this returned context to make access control decisions will erroneously treat these unauthorized entities as legitimate authenticated users.
The operational impact of this flaw is severe, particularly in environments where Role-Based Access Control (RBAC) or other identity-based security policies are enforced via gRPC metadata and authentication contexts. The @grpc/grpc-js-xds component is explicitly noted to be susceptible when RBAC authentication is enabled in affected configurations. An attacker can exploit this by presenting a self-signed, expired, or otherwise invalid certificate during the TLS handshake. Because the server accepts the connection due to requireClientCertificate being false, and subsequently misinterprets the failed validation as success via getAuthContext, the application layer will grant access based on flawed authentication data. This constitutes an improper authentication vulnerability that allows unauthorized entities to bypass security controls designed to restrict access to specific roles or identities.
This issue aligns with CWE-287, which describes Improper Authentication, where a system fails to correctly verify identity credentials before granting access. Furthermore, from the perspective of the MITRE ATT&CK framework, this vulnerability facilitates Initial Access techniques such as T1078 Valid Accounts if an attacker can spoof or manipulate certificate identities that are subsequently accepted by the application logic. The exploitation does not require complex network manipulation but rather a straightforward presentation of invalid credentials during the standard TLS handshake process, making it relatively easy to exploit in misconfigured environments where client certificates are optional but still utilized for identity assertion.
Mitigation requires upgrading grpc/grpc-js to version 1.14.5 or later and grpc/grpc-js-xds to corresponding patched versions that resolve this logic error. In the interim, organizations should review their gRPC server configurations to ensure that requireClientCertificate is set to true if client certificate validation is critical for security posture, thereby forcing strict verification of all presented certificates regardless of subsequent context retrieval flaws. Additionally, implementing defense-in-depth strategies such as validating authentication contexts at multiple layers and monitoring for anomalous connection patterns can help detect exploitation attempts until the software update is applied. Regular auditing of TLS configurations and ensuring that certificate validation failures are explicitly handled rather than implicitly ignored is essential to maintaining robust security in gRPC-based microservices architectures.