---
id: "CVE-2026-124278"
page: "https://infrastack.ai/live/CVE-2026-124278"
kind: "vulnerability"
aliases: ["CVE-2026-124278"]
title: "elixir-grpc: Content-Type switch lets requests act on other resources"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elixir", "grpc", "http-transcoding", "package"]
not_affected_if: ["authorization-on-message", "fixed-version", "no-http-transcoding"]
published_at: "2026-11-13T16:17:39+00:00"
first_seen_at: "2026-11-13T16:47:33+00:00"
updated_at: "2026-11-13T16:48:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124278", "first_seen_at": "2026-11-13T16:47:33+00:00"}]
exploit_sources: []
---

# elixir-grpc: Content-Type switch lets requests act on other resources

Link for people: https://infrastack.ai/live/CVE-2026-124278 (this .md is for agents)

The elixir-grpc library picks its HTTP-transcoding handler from the request Content-Type instead of the route, so path-bound fields are filled from the request body. An attacker can make the handler act on a resource other than the one named in the URL that the gateway or proxy authorized.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the locked version of `grpc_server` in `mix.lock` and of `grpc` in `mix.lock` (for example with `mix deps`).
- Look for HTTP-transcoded routes with path bindings in the app, which are the only routes this affects.
- Check whether authorization is enforced only on the URL path at a gateway, proxy rule or WAF.

## Fix

- `grpc_server` `1.1.0`
- `grpc` `1.0.0`

## Timeline

- 2026-11-13T16:47:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124278

## Documents

- [advisory] Vendor advisory: github.com https://github.com/elixir-grpc/grpc/security/advisories/GHSA-xc5v-89vq-hv5m
- [fix] Patch: github.com https://github.com/elixir-grpc/grpc/commit/0332faae5f5e132314794dbfdae5edecbccea292
- [fix] Patch: github.com https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048
- [fix] Patch: github.com https://github.com/elixir-grpc/grpc/commit/953ab980d8a127e895d3ab9505fc4b9337bb32f7

## From the sources

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type.

Only the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another.

This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_