CVE-2026-37236

Received Received - Intake

Incorrect Access Control in grpc-gateway

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: MITRE

Description

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-37236

EUVD

EUVD-2026-67776

Affected Vendors & Products

Vendor	Product	Version / Range
grpc_gateway	grpc_gateway	2.28.0
grpc-ecosystem	grpc-gateway	to 2.28.0 (inc)
grpc-ecosystem	grpc-gateway	From 2.29.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

grpc-gateway v2.28.0 allows HTTP method override via the X-HTTP-Method-Override header in POST requests with Content-Type application/x-www-form-urlencoded. This lets attackers change the request method to bypass access controls enforced by upstream proxies or WAFs.

Detection Guidance

To detect this vulnerability, inspect HTTP requests for POST requests containing the X-HTTP-Method-Override header with Content-Type application/x-www-form-urlencoded. Use tools like tcpdump, Wireshark, or proxy logs to monitor for such headers. Check if grpc-gateway versions up to 2.28.0 are deployed by examining server version strings or dependency manifests.

Impact Analysis

Attackers could bypass security controls to access restricted endpoints like DELETE or PUT methods. This may allow unauthorized data modification, deletion, or access to sensitive handlers that should be blocked.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's access control requirements. Compliance may be compromised if method-based access controls are bypassed.

Mitigation Strategies

Upgrade grpc-gateway to version 2.29.0 or later. Enable the WithDisableHTTPMethodOverride option in ServeMux configuration. Alternatively, configure upstream proxies or WAFs to strip or normalize the X-HTTP-Method-Override header before forwarding requests to grpc-gateway.

Hi! I’m here to help you understand CVE-2026-37236. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70