CVE-2026-128065: @grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied

Summary

XdsServer in @grpc/grpc-js-xds does not apply RBACPerRoute overrides from matching Route or VirtualHost resources. When a trusted xDS control plane supplies a broad top-level ALLOW policy and a stricter override, XdsServer ACKs the resources but evaluates the RPC under the top-level policy.

Details

Override parser lookup uses the override message type

parseOverrideFilterConfig() in packages/grpc-js-xds/src/http-filter.ts:225-257 looks up FILTERREGISTRY using the override message type:

type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter.ts#L225-L257

setup() in packages/grpc-js-xds/src/http-filter/rbac-filter.ts:167-173 registers the filter only under the top-level RBAC type:

type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter/rbac-filter.ts#L167-L173

The lookup returns null even though the registered entry contains parseOverrideRbacConfig(), and server.ts silently skips the override.

Override maps are keyed by type URL instead of filter name

overrideConfigMaps in server.ts:99-102 is documented as keyed by HTTP filter name, but server.ts:169-174 stores each map under filterConfig.typeUrl.

Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L99-L102

Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L169-L174

Route overrides are later looked up by their typedperfilterconfig key, which is the HttpFilter.name. An ordinary key such as rbac therefore misses the stored map.

VirtualHost overrides are not read

handleRouteConfigurationResource() in server.ts:225-249 reads route.typedperfilterconfig but never reads virtualHost.typedperfilterconfig.

Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L225-L249

When no override reaches the RBAC interceptor, rbac-filter.ts:125-155 evaluates the broader top-level policy.

Proof of concept

Set: GRPCXDSEXPERIMENTALRBAC=true

Run XdsServer with a protected unary handler.

Have the ADS control plane deliver a Listener containing an RBAC HTTP filter named rbac with a top-level ALLOW-any policy:

name: rbac typedconfig: "@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC rules: action: ALLOW policies: allow-any: principals: [{ any: true }] permissions: [{ any: true }]

Deliver a matching non-forwarding route with this override:

typedperfilterconfig: rbac: "@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute rbac: rules: action: DENY policies: deny-any: principals: [{ any: true }] permissions: [{ any: true }]

Invoke the protected unary method without credentials.

Expected: The route-specific DENY policy rejects the RPC before the protected handler runs.

Observed: XdsServer ACKs the resources, retains the top-level ALLOW policy, and runs the protected handler.

Listener and RouteConfiguration: ACKED gRPC status: OK handler invocations: 1 response: PROTECTEDSECRETRECORDRBACOVERRIDE

Impact

Users of @grpc/grpc-js-xds who are using RBAC-based authentication with override configurations may unintentionally accept some requests that should be rejected.

— GitHub