Bug 2525631 (CVE-2026-37236) - CVE-2026-37236 github.com/grpc-ecosystem/grpc-gateway: grpc-gateway: Access control bypass via X-HTTP-Method-Override header
Summary: CVE-2026-37236 github.com/grpc-ecosystem/grpc-gateway: grpc-gateway: Access c...
Keywords:
Status: NEW
Alias: CVE-2026-37236
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2528406 2528407 2528408 2528409 2528410 2528411 2528412 2528413
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-28 15:33 UTC by OSIDB Bzimport
Modified: 2026-09-04 06:10 UTC (History)
71 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-28 15:33:19 UTC 
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
Note You need to log in before you can comment on or make changes to this bug.