CVE-2026-124278
Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server
- High 7.6
Description
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type. Only the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another. This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.
Key facts
- Published
- 13 Nov 2026
- Last changed
- 13 Nov 2026
- Assigned by
- EEF
- EPSS
- 0.496% likely to be exploited in the next 30 days, higher than 43.109% of CVEs (scores for 15 Nov 2026)
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 7.6CVSS 4.0, Highfrom the CNA (EEF)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant's data. (CNA impact statement)
No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| elixir-grpc | grpc_server |
|
| elixir-grpc | grpc_server |
|
| elixir-grpc | grpc |
|
| elixir-grpc | grpc |
|
Timeline
- 13 Nov 2026 Published