CVE-2026-124278 · Package
NO FIX YET · SEE WHAT TO DO
The elixir-grpc library picks its HTTP-transcoding handler from the request Content-Type instead of the route, so path-bound fields are filled from the request body. An attacker can make the handler act on a resource other than the one named in the URL that the gateway or proxy authorized.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use grpc_server from 1.0.0 before 1.1.0, or grpc from 0.8.0 before 1.0.0, are exposed. The risk is highest where HTTP-transcoded routes with path bindings exist and authorization happens only on the URL path at a gateway, proxy or WAF. Services without transcoded routes, or that authorize on the decoded message, can skip it.
Not affected if authorization-on-message, fixed-version, no-http-transcoding
Who cares elixir, grpc, http-transcoding
grpc_server in mix.lock and of grpc in mix.lock (for example with mix deps).grpc_server 1.1.0Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.
Only the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.
This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
grpc 1.0.0This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.