{"id":"CVE-2026-124278","kind":"vulnerability","aliases":["CVE-2026-124278"],"related":[],"title":"elixir-grpc: Content-Type switch lets requests act on other resources","description":"Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.\n\nOnly the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.\n\nThis issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.","summary":"The elixir-grpc library picks its HTTP-transcoding handler from the request Content-Type instead of the route, so path-bound fields are filled from the request body. An attacker can make the handler act on a resource other than the one named in the URL that the gateway or proxy authorized.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elixir","grpc","http-transcoding","package"],"not_affected_if":["authorization-on-message","fixed-version","no-http-transcoding"],"how_to_check":"- Check the locked version of `grpc_server` in `mix.lock` and of `grpc` in `mix.lock` (for example with `mix deps`).\n- Look for HTTP-transcoded routes with path bindings in the app, which are the only routes this affects.\n- Check whether authorization is enforced only on the URL path at a gateway, proxy rule or WAF.","fix":"- `grpc_server` `1.1.0`\n- `grpc` `1.0.0`","status":"open","published_at":"2026-11-13T16:17:39+00:00","first_seen_at":"2026-11-13T16:47:33+00:00","triaged_at":"2026-11-13T16:48:43+00:00","updated_at":"2026-11-13T16:48:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T16:48:43Z","model":"claude-haiku-5-5","output":{"fix":"- `grpc_server` `1.1.0`\n- `grpc` `1.0.0`","reach":"unknown","title":"elixir-grpc: Content-Type switch lets requests act on other resources","impact":"high","summary":"The elixir-grpc library picks its HTTP-transcoding handler from the request Content-Type instead of the route, so path-bound fields are filled from the request body. An attacker can make the handler act on a resource other than the one named in the URL that the gateway or proxy authorized.","audience":"developers","category":"package","nicknames":[],"who_cares":["elixir","grpc","http-transcoding"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reaches resources the URL-level authorization was meant to block","analyst_note":"","how_to_check":"- Check the locked version of `grpc_server` in `mix.lock` and of `grpc` in `mix.lock` (for example with `mix deps`).\n- Look for HTTP-transcoded routes with path bindings in the app, which are the only routes this affects.\n- Check whether authorization is enforced only on the URL path at a gateway, proxy rule or WAF.","plain_action":"","product_name":"grpc_server","needs_analyst":false,"not_affected_if":["fixed-version","no-http-transcoding","authorization-on-message"],"who_is_affected":"Applications that use grpc_server from 1.0.0 before 1.1.0, or grpc from 0.8.0 before 1.0.0, are exposed. The risk is highest where HTTP-transcoded routes with path bindings exist and authorization happens only on the URL path at a gateway, proxy or WAF. Services without transcoded routes, or that authorize on the decoded message, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001414,"input_tokens":4845,"output_tokens":1860,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124278':16A,19A '-2026':15A,18A '0.8.0':233C '1.0.0':228C,235C '1.1.0':230C 'act':10A,64B,105C 'affect':224C 'allow':98C 'alon':189C 'anoth':221C 'appli':148C 'application/grpc':181C 'application/grpc-web':183C 'attack':59B,100C 'author':81B,82C,209C 'bind':153C 'bodi':57B,188C,201C 'bound':50B,194C 'bypass':83C 'claus':135C,163C 'content':5A,41B,130C,168C 'content-typ':4A,40B,129C,167C 'control':87C 'cowboy':159C 'cve':14A,17A 'decod':185C 'elixir':2A,20B,28B,92C 'elixir-grpc':1A,27B,91C 'everi':191C 'field':51B,195C 'fill':53B 'gateway':78B,203C 'grpc':3A,21B,29B,93C,94C,97C,128C,140C,225C,231C 'grpc.server.do':137C 'handl':138C 'handler':36B,63B,104C,160C,219C 'http':23B,34B,120C 'http-transcod':22B,33B,119C 'instead':43B 'issu':223C 'key':88C 'let':8A 'lib/grpc/server.ex':143C 'librari':30B 'make':61B,102C 'messag':157C 'name':72B,113C 'one':71B,112C,215C 'packag':25B,146C 'path':49B,152C,193C,213C 'path-bound':48B,192C 'pick':31B,161C 'proxi':80B,204C 'receiv':220C 'request':9A,39B,56B,125C,156C,166C,175C 'request/4':139C 'resourc':13A,67B,108C,216C 'rout':46B,122C,150C,173C 'rule':205C 'see':214C 'server':95C,226C 'server/lib/grpc/server.ex':141C 'split':147C 'switch':7A 'take':196C 'transcod':24B,35B,121C,134C,178C 'type':6A,42B,131C,169C 'url':75B,116C,179C,212C 'user':86C 'user-control':85C 'valu':198C 'via':123C 'vulner':89C 'waf':207C","nicknames":[],"mitigations":[],"who_affected":"Applications that use grpc_server from 1.0.0 before 1.1.0, or grpc from 0.8.0 before 1.0.0, are exposed. The risk is highest where HTTP-transcoded routes with path bindings exist and authorization happens only on the URL path at a gateway, proxy or WAF. Services without transcoded routes, or that authorize on the decoded message, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elixir","grpc","high","httptranscoding","package"],"campaign_type":null,"search_a":"'-124278':16A,19A '-2026':15A,18A 'act':10A 'content':5A 'content-typ':4A 'cve':14A,17A 'elixir':2A 'elixir-grpc':1A 'grpc':3A 'let':8A 'request':9A 'resourc':13A 'switch':7A 'type':6A","search_b":"'act':64B 'attack':59B 'author':81B 'bodi':57B 'bound':50B 'content':41B 'content-typ':40B 'elixir':20B,28B 'elixir-grpc':27B 'field':51B 'fill':53B 'gateway':78B 'grpc':21B,29B 'handler':36B,63B 'http':23B,34B 'http-transcod':22B,33B 'instead':43B 'librari':30B 'make':61B 'name':72B 'one':71B 'packag':25B 'path':49B 'path-bound':48B 'pick':31B 'proxi':80B 'request':39B,56B 'resourc':67B 'rout':46B 'transcod':24B,35B 'type':42B 'url':75B","search_c":"'0.8.0':233C '1.0.0':228C,235C '1.1.0':230C 'act':105C 'affect':224C 'allow':98C 'alon':189C 'anoth':221C 'appli':148C 'application/grpc':181C 'application/grpc-web':183C 'attack':100C 'author':82C,209C 'bind':153C 'bodi':188C,201C 'bound':194C 'bypass':83C 'claus':135C,163C 'content':130C,168C 'content-typ':129C,167C 'control':87C 'cowboy':159C 'decod':185C 'elixir':92C 'elixir-grpc':91C 'everi':191C 'field':195C 'gateway':203C 'grpc':93C,94C,97C,128C,140C,225C,231C 'grpc.server.do':137C 'handl':138C 'handler':104C,160C,219C 'http':120C 'http-transcod':119C 'issu':223C 'key':88C 'lib/grpc/server.ex':143C 'make':102C 'messag':157C 'name':113C 'one':112C,215C 'packag':146C 'path':152C,193C,213C 'path-bound':192C 'pick':161C 'proxi':204C 'receiv':220C 'request':125C,156C,166C,175C 'request/4':139C 'resourc':108C,216C 'rout':122C,150C,173C 'rule':205C 'see':214C 'server':95C,226C 'server/lib/grpc/server.ex':141C 'split':147C 'take':196C 'transcod':121C,134C,178C 'type':131C,169C 'url':116C,179C,212C 'user':86C 'user-control':85C 'valu':198C 'via':123C 'vulner':89C 'waf':207C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:27:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124278","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124278","severity":null,"published_at":"2026-11-13T16:17:39+00:00","modified_at":"2026-11-13T16:17:39+00:00","first_seen_at":"2026-11-13T16:47:33+00:00","fetched_at":"2026-11-13T16:47:33+00:00","note":null}],"documents":[{"id":147636,"url":"https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":147644,"url":"https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":147645,"url":"https://github.com/elixir-grpc/grpc/commit/953ab980d8a127e895d3ab9505fc4b9337bb32f7","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":147646,"url":"https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xc5v-89vq-hv5m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-13T15:27:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}