CVE-2026-37236: Grpc-gateway vulnerability
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
grpc-gatewayto a version that resolves this vulnerability.Fixed in 2.28.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using grpc-gateway v2.28.0 are exposed when requests can reach ServeMux.ServeHTTP through an upstream proxy or WAF that applies access controls based on the original HTTP method.
What does an attacker need to exploit it?
An attacker needs to send a POST request with Content-Type application/x-www-form-urlencoded and an X-HTTP-Method-Override header containing the method they want the gateway to route. The gateway rewrites the method before routing.
Are all requests affected by the method override behavior?
The described behavior applies when the request is a POST with Content-Type application/x-www-form-urlencoded and includes X-HTTP-Method-Override. The supplied data does not establish whether this is enabled or reachable in every deployment configuration.
What can be done if patching is not immediately possible?
Restrict or remove X-HTTP-Method-Override at the proxy, WAF, or application boundary, and ensure access controls evaluate the effective method used for routing rather than only the original request method.