CVE-2026-37236 in grpc-gateway
Summary
by MITRE • 08/28/2026
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability in grpc-gateway version 2.28.0 represents a critical flaw in how HTTP method overrides are handled within the ServeMux component, specifically affecting applications that rely on standard HTTP semantics for security enforcement. The core technical issue stems from the unvalidated processing of the X-HTTP-Method-Override header during request routing. When an incoming POST request contains this specific header along with a Content-Type of application/x-www-form-urlencoded, the framework automatically rewrites the effective HTTP method to whatever value is supplied in that header before passing the request to subsequent handlers or upstream services. This behavior occurs without any restriction on which methods are permitted for such overrides, creating a significant gap in access control logic.
This architectural oversight allows attackers to bypass security mechanisms that depend on strict adherence to standard HTTP verbs. Many organizations implement Web Application Firewalls (WAFs) and reverse proxies that enforce method-based policies, typically allowing only GET or POST requests while blocking dangerous methods like DELETE, PUT, PATCH, or OPTIONS for certain endpoints. By exploiting this vulnerability, an attacker can send a seemingly benign POST request with the X-HTTP-Method-Override header set to a restricted verb such as DELETE. The grpc-gateway component then treats the request as if it were originally sent using that forbidden method, effectively circumventing the upstream security controls designed to block such actions. This bypass technique is particularly dangerous because it exploits the trust placed in internal routing logic over external perimeter defenses.
From an operational impact perspective, this vulnerability can lead to unauthorized data modification or deletion, depending on the functionality exposed by the gRPC services behind the gateway. If the underlying service endpoints are not independently secured against method-based restrictions, attackers could exploit this to perform destructive actions such as deleting user records, altering configuration settings, or escalating privileges if those methods trigger administrative functions. The impact is compounded by the fact that many security monitoring systems may log these requests as POST operations due to their initial transmission format, potentially masking malicious activity from intrusion detection systems that rely on HTTP method signatures for anomaly detection.
This flaw aligns with CWE-284, which describes Improper Access Control, specifically relating to insufficient restrictions on actions performed by authenticated users or automated processes. It also maps closely to MITRE ATT&CK technique T1505.003, known as Server Side Request Forgery via HTTP Method Override, although in this context it is more accurately categorized under privilege escalation through access control bypass rather than pure SSRF. The vulnerability highlights the risks associated with implicit trust in header values and the dangers of allowing dynamic method switching without rigorous validation against a whitelist of allowed operations.
To mitigate this risk, developers must implement strict allow-listing for HTTP methods that are permitted to be overridden via headers like X-HTTP-Method-Override. It is recommended to configure the ServeMux or middleware layer to validate the target method against a predefined list of safe verbs before applying any override logic. Additionally, organizations should ensure that upstream proxies and WAFs enforce security policies based on the actual intended action rather than just the initial HTTP verb, although this requires careful configuration to avoid breaking legitimate functionality. Upgrading to patched versions where such overrides are restricted or disabled by default is essential for immediate remediation. Furthermore, auditing all gRPC gateway configurations to ensure that no critical endpoints rely solely on method-based access controls without additional authentication and authorization checks will help reduce the attack surface associated with this type of logic flaw.