HTTP-to-gRPC transcoding must be enabled with http_transcode: true. Access to a resource must be decided from the URL path rather than from the decoded request, for example by an API gateway, proxy rule or WAF in front of the server.
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.
\nOnly the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.
This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.
"},{"base64":false,"type":"text/markdown","value":"Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\n\nOnly the transcoding clause of `GRPC.Server.do_handle_request/4` (`grpc_server/lib/grpc/server.ex`, and `lib/grpc/server.ex` before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request `Content-Type`, not from the route. A request to a transcoded URL with `application/grpc` or `application/grpc-web` is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0."}],"value":"Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\n\nOnly the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0."}],"impacts":[{"capecId":"CAPEC-460","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant's data.
"},{"base64":false,"type":"text/markdown","value":"An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant's data."}],"value":"An attacker whose requests are authorized by URL path can make the handler read or modify a resource the path does not name, such as another tenant's data."}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":7.6,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-436","description":"CWE-436 Interpretation Conflict","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-13T15:58:08.134Z","orgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","shortName":"EEF"},"references":[{"name":"Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server","tags":["vendor-advisory","related"],"url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xc5v-89vq-hv5m"},{"name":"EEF CNA record for CVE-2026-124278","tags":["related"],"url":"https://cna.erlef.org/cves/CVE-2026-124278.html"},{"name":"OSV record EEF-CVE-2026-124278","tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-124278"},{"name":"Introducing commit 0332faa in elixir-grpc/grpc","tags":["related"],"url":"https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292"},{"name":"Fix commit 953ab98 in elixir-grpc/grpc","tags":["patch"],"url":"https://github.com/elixir-grpc/grpc/commit/953ab980d8a127e895d3ab9505fc4b9337bb32f7"},{"name":"Introducing commit 8aaf3d3 in elixir-grpc/grpc","tags":["related"],"url":"https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048"}],"source":{"discovery":"EXTERNAL"},"title":"Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server","x_proofOfConcept":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"http_transcode: true and a transcoded route that binds a field from the path, for example GET /v1/messages/{name}.name to victim.GET /v1/messages/alice with Content-Type: application/grpc.name set to victim, not alice.1. The header selects the clause
\nThe Cowboy handler derives the access mode from the request Content-Type. application/json selects :http_transcoding, application/grpc selects :grpc and application/grpc-web+proto selects :grpcweb. The router still matches the transcoded URL template and extracts its path bindings.
2. Bindings are applied in one clause only
\nGRPC.Server.do_handle_request/4 reads the bindings with adapter.get_bindings/1 and merges them through GRPC.Server.Transcode.map_request/5 only in the :http_transcoding clause. The unary and request-streaming clauses decode the body alone with the selected codec. GRPC.Codec.Proto is in the default codecs of every server, so application/grpc is always accepted.
3. The HTTP/1.1 guard never matches
\nresolve_access_mode/3 has a clause that forces transcoding for HTTP/1.1 requests. It matches the version as the binary \"HTTP/1.1\", while Cowboy stores the version as an atom, so the clause never applies and the request works over plain HTTP/1.1.
4. Result
\nA request to /v1/messages/alice with Content-Type: application/grpc and a message that sets name to victim reaches the handler with name set to victim. With an empty message the field is empty: the path binding is never consulted.