Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

grpc-gateway 2.28.0 permits unauthorized method changes

CVE-2026-37236 · published 6 days ago
Summary

The grpc-gateway library version 2.28.0 accepts the X-HTTP-Method-Override header without checking which methods are allowed. An attacker can send a POST request that changes the request method to anything they choose, potentially bypassing rules that block certain actions. Upgrade to a newer version of grpc-gateway or configure the server to reject or ignore the X-HTTP-Method-Override header.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Ubuntu:18.04:LTS canonical golang-github-grpc-ecosystem-grpc-gateway All versions
Original advisory text
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST re...
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
References
Severity
9.8 Critical
Exploitation
EPSS <1%
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published28 Aug 2026
Updated4 Sep 2026
First seen28 Aug 2026
Sources
CVE-2026-37236 · NVD
CVE-2026-37236 · MITRE
UBUNTU-CVE-2026-37236 · OSV
Monitor software like this
Free during beta