Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server

Summary

CVE	CVE-2026-124278
State	PUBLISHED
Assigner	EEF
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-11-13 16:17:39 UTC
Updated	2026-11-13 16:17:39 UTC
Description	Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type. Only the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another. This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.

Risk And Classification

Primary CVSS: v4.0 7.6 HIGH from 6b3ad84c-e1a6-4bf7-a703-f496b71e49db

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Problem Types: CWE-436 | CWE-639 | CWE-436 CWE-436 Interpretation Conflict | CWE-639 CWE-639 Authorization Bypass Through User-Controlled Key

Version	Source	Type	Score	Severity	Vector
4.0	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	Secondary	7.6	HIGH	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/C...`
4.0	CNA	CVSS	7.6	HIGH	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`

CVSS v4.0 Breakdown

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

Low

User Interaction

None

Confidentiality

High

Integrity

High

Availability

None

Sub Conf.

None

Sub Integrity

None

Sub Availability

None

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Elixir-grpc	Grpc Server	affected 1.0.0 1.1.0 semver	Not specified
CNA	Elixir-grpc	Grpc Server	affected 0332faae5f5e132314794dbfdae5edecbccea292 953ab980d8a127e895d3ab9505fc4b9337bb32f7 git	Not specified
CNA	Elixir-grpc	Grpc	affected 0.8.0 1.0.0 semver	Not specified
CNA	Elixir-grpc	Grpc	affected 8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048 0332faae5f5e132314794dbfdae5edecbccea292 git	Not specified

References

Reference	Source	Link	Tags
github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	github.com
github.com/elixir-grpc/grpc/security/advisories/GHSA-xc5v-89vq-hv5m	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	github.com
cna.erlef.org/cves/CVE-2026-124278.html	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	cna.erlef.org
github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	github.com
github.com/elixir-grpc/grpc/commit/953ab980d8a127e895d3ab9505fc4b9337bb32f7	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	github.com
osv.dev/vulnerability/EEF-CVE-2026-124278	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	osv.dev
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Eurico Nicacio (en)

CNA: Paulo Valente (en)

CNA: Peter Ullrich (en)

CNA: Jonatan Männchen / EEF (en)

There are currently no legacy QID mappings associated with this CVE.