{"id":"CVE-2026-128065","kind":"vulnerability","aliases":["CVE-2026-128065","GHSA-gg5j-6742-v827"],"related":[],"title":"@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied","description":"### Summary\n\n`XdsServer` in `@grpc/grpc-js-xds` does not apply `RBACPerRoute` overrides from matching Route or VirtualHost resources. When a trusted xDS control plane supplies a broad top-level ALLOW policy and a stricter override, `XdsServer` ACKs the resources but evaluates the RPC under the top-level policy.\n\n### Details\n\n### Override parser lookup uses the override message type\n\n`parseOverrideFilterConfig()` in packages/grpc-js-xds/src/http-filter.ts:225-257 looks up FILTER_REGISTRY using the override message type:\n\n`type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute`\nSource: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter.ts#L225-L257\n\n`setup()` in packages/grpc-js-xds/src/http-filter/rbac-filter.ts:167-173 registers the filter only under the top-level RBAC type:\n\n`type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC`\nSource: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter/rbac-filter.ts#L167-L173\n\nThe lookup returns null even though the registered entry contains `parseOverrideRbacConfig()`, and server.ts silently skips the override.\n\n### Override maps are keyed by type URL instead of filter name\n\n`overrideConfigMaps` in server.ts:99-102 is documented as keyed by HTTP filter name, but server.ts:169-174 stores each map under `filterConfig.typeUrl`.\n\nSource: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L99-L102\n\nSource: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L169-L174\n\nRoute overrides are later looked up by their `typed_per_filter_config` key, which is the `HttpFilter.name`. An ordinary key such as rbac therefore misses the stored map.\n\n### VirtualHost overrides are not read\n\n`handleRouteConfigurationResource()` in server.ts:225-249 reads `route.typed_per_filter_config` but never reads `virtualHost.typed_per_filter_config`.\n\nSource: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L225-L249\n\nWhen no override reaches the RBAC interceptor, rbac-filter.ts:125-155 evaluates the broader top-level policy.\n\n### Proof of concept\n\nSet:\n```\nGRPC_XDS_EXPERIMENTAL_RBAC=true\n```\n\nRun `XdsServer` with a protected unary handler.\n\nHave the ADS control plane deliver a Listener containing an RBAC HTTP filter named rbac with a top-level ALLOW-any policy:\n\n```\nname: rbac\ntyped_config:\n  \"@type\": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC\n  rules:\n    action: ALLOW\n    policies:\n      allow-any:\n        principals: [{ any: true }]\n        permissions: [{ any: true }]\n```\n\nDeliver a matching non-forwarding route with this override:\n\n```\ntyped_per_filter_config:\n  rbac:\n    \"@type\": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute\n    rbac:\n      rules:\n        action: DENY\n        policies:\n          deny-any:\n            principals: [{ any: true }]\n            permissions: [{ any: true }]\n```\n\nInvoke the protected unary method without credentials.\n\nExpected: The route-specific DENY policy rejects the RPC before the protected handler runs.\n\nObserved: `XdsServer` ACKs the resources, retains the top-level ALLOW policy, and runs the protected handler.\n\n```\nListener and RouteConfiguration: ACKED\ngRPC status: OK\nhandler invocations: 1\nresponse: PROTECTED_SECRET_RECORD_RBAC_OVERRIDE\n```\n\n### Impact\n\nUsers of `@grpc/grpc-js-xds` who are using RBAC-based authentication with override configurations may unintentionally accept some requests that should be rejected.","summary":"In @grpc/grpc-js-xds, RBAC override policies from matching Route or VirtualHost resources are not applied, so the server evaluates only the broader top-level ALLOW policy. An unauthenticated caller can reach a protected RPC handler that a route-specific DENY policy should have blocked.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@grpc/grpc-js-xds","fixed":["1.14.2"],"affected":">= 1.14.0, < 1.14.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-863","grpc","grpc-js-xds","node","package","rbac","xds"],"not_affected_if":["auth-enforced-elsewhere","default-config","xds-rbac-unused"],"how_to_check":"- Check the installed version with `npm ls @grpc/grpc-js-xds`.\n- Look for RBAC HTTP filters delivered via xDS with `typed_per_filter_config` overrides, and whether `GRPC_XDS_EXPERIMENTAL_RBAC=true` is set.","fix":"- `@grpc/grpc-js-xds` `1.14.2`","status":"open","published_at":"2026-11-12T22:55:47+00:00","first_seen_at":"2026-11-12T22:57:32+00:00","triaged_at":"2026-11-12T22:59:07+00:00","updated_at":"2026-11-12T22:59:07+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T22:59:07Z","model":"claude-haiku-5-5","output":{"fix":"- `@grpc/grpc-js-xds` `1.14.2`","reach":"network","title":"gRPC xDS: route and virtual host RBAC overrides ignored, allowing unauthorized calls","impact":"high","summary":"In @grpc/grpc-js-xds, RBAC override policies from matching Route or VirtualHost resources are not applied, so the server evaluates only the broader top-level ALLOW policy. An unauthenticated caller can reach a protected RPC handler that a route-specific DENY policy should have blocked.","audience":"developers","category":"package","nicknames":[],"who_cares":["grpc-js-xds","xds","rbac","node","grpc"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated callers reach protected RPC handlers and read their data.","analyst_note":"","how_to_check":"- Check the installed version with `npm ls @grpc/grpc-js-xds`.\n- Look for RBAC HTTP filters delivered via xDS with `typed_per_filter_config` overrides, and whether `GRPC_XDS_EXPERIMENTAL_RBAC=true` is set.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["xds-rbac-unused","default-config","auth-enforced-elsewhere"],"who_is_affected":"Applications that use @grpc/grpc-js-xds with xDS-delivered RBAC policies, where a top-level ALLOW policy is combined with route or virtual host RBACPerRoute overrides that restrict access. Exposure also requires the experimental RBAC flag to be enabled. Teams that do not use xDS RBAC, or that enforce access control elsewhere, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000946,"input_tokens":6193,"output_tokens":653,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102':212C '-128065':15A,23A '-155':298C '-173':162C '-174':223C '-2026':14A,22A '-249':273C '-257':141C '-863':26B '/envoy.extensions.filters.http.rbac.v3.rbac':176C,353C '/envoy.extensions.filters.http.rbac.v3.rbacperroute':153C,385C '/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter.ts#l225-l257':157C '/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter/rbac-filter.ts#l167-l173':180C '/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#l169-l174':236C '/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#l225-l249':289C '/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#l99-l102':232C '1':448C '167':161C '225':140C '6742':19A 'accept':471C 'ack':115C,424C,442C 'action':355C,388C 'ad':324C 'allow':60B,108C,343C,356C,359C,432C 'allow-ani':342C,358C 'appli':12A,49B,87C 'authent':465C 'base':464C 'block':80B 'broad':104C 'broader':56B,301C 'caller':64B 'concept':308C 'config':4A,248C,278C,285C,349C,380C 'configur':468C 'contain':190C,330C 'control':100C,325C 'credenti':406C 'cve':13A,21A 'cwe':25B 'deliv':327C,367C 'deni':76B,389C,392C,412C 'deny-ani':391C 'detail':128C 'document':214C 'entri':189C 'evalu':53B,119C,299C 'even':185C 'expect':407C 'experiment':312C 'filter':144C,165C,207C,219C,247C,277C,284C,334C,379C 'filterconfig.typeurl':228C 'forward':372C 'gg5j':18A 'ghsa':17A 'ghsa-gg5j':16A 'github.com':156C,179C,231C,235C,288C 'github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter.ts#l225-l257':155C 'github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter/rbac-filter.ts#l167-l173':178C 'github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#l169-l174':234C 'github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#l225-l249':287C 'github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#l99-l102':230C 'grpc':27B,29B,310C,443C 'grpc-js-xds':28B 'grpc/grpc-js':1A 'grpc/grpc-js-xds':24A,37B,84C,458C 'handler':70B,321C,420C,438C,446C 'handlerouteconfigurationresourc':270C 'http':218C,333C 'httpfilter.name':253C 'impact':455C 'instead':205C 'interceptor':296C 'invoc':447C 'invok':400C 'js':30B 'key':201C,216C,249C,256C 'later':240C 'level':59B,107C,126C,171C,304C,341C,431C 'listen':329C,439C 'look':142C,241C 'lookup':131C,182C 'map':199C,226C,264C 'match':42B,91C,369C 'may':469C 'messag':135C,149C 'method':404C 'miss':261C 'name':208C,220C,335C,346C 'never':280C 'node':32B 'non':371C 'non-forward':370C 'null':184C 'observ':422C 'ok':445C 'ordinari':255C 'overrid':3A,39B,89C,113C,129C,134C,148C,197C,198C,238C,266C,292C,376C,454C,467C 'overrideconfigmap':209C 'packag':33B 'packages/grpc-js-xds/src/http-filter.ts':139C 'packages/grpc-js-xds/src/http-filter/rbac-filter.ts':160C 'parseoverridefilterconfig':137C 'parseoverriderbacconfig':191C 'parser':130C 'per':246C,276C,283C,378C 'permiss':364C,397C 'plane':101C,326C 'polici':40B,61B,77B,109C,127C,305C,345C,357C,390C,413C,433C 'princip':361C,394C 'proof':306C 'protect':68B,319C,402C,419C,437C,450C 'rbac':2A,34B,38B,172C,259C,295C,313C,332C,336C,347C,381C,386C,453C,463C 'rbac-bas':462C 'rbac-filter.ts:125':297C 'rbacperrout':88C 'reach':66B,293C 'read':269C,274C,281C 'record':452C 'regist':163C,188C 'registri':145C 'reject':414C,477C 'request':473C 'resourc':9A,46B,95C,117C,426C 'respons':449C 'retain':427C 'return':183C 'rout':8A,43B,74B,92C,237C,373C,410C 'route-specif':73B,409C 'route.typed':275C 'routeconfigur':441C 'rpc':69B,121C,416C 'rule':354C,387C 'run':315C,421C,435C 'secret':451C 'server':52B 'server.ts':193C 'server.ts:169':222C 'server.ts:225':272C 'server.ts:99':211C 'set':309C 'setup':158C 'silent':194C 'skip':195C 'sourc':154C,177C,229C,233C,286C 'specif':75B,411C 'status':444C 'store':224C,263C 'stricter':112C 'summari':81C 'suppli':102C 'therefor':260C 'though':186C 'top':58B,106C,125C,170C,303C,340C,430C 'top-level':57B,105C,124C,169C,302C,339C,429C 'true':314C,363C,366C,396C,399C 'trust':98C 'type':136C,150C,173C,203C,245C,348C,350C,377C,382C 'type.googleapis.com':152C,175C,352C,384C 'type.googleapis.com/envoy.extensions.filters.http.rbac.v3.rbac':174C,351C 'type.googleapis.com/envoy.extensions.filters.http.rbac.v3.rbacperroute':151C,383C 'unari':320C,403C 'unauthent':63B 'unintent':470C 'url':204C 'use':132C,146C,461C 'user':456C 'v827':20A 'virtualhost':6A,45B,94C,265C 'virtualhost.typed':282C 'without':405C 'xds':31B,35B,99C,311C 'xdsserver':82C,114C,316C,423C","nicknames":[],"mitigations":[],"who_affected":"Applications that use @grpc/grpc-js-xds with xDS-delivered RBAC policies, where a top-level ALLOW policy is combined with route or virtual host RBACPerRoute overrides that restrict access. Exposure also requires the experimental RBAC flag to be enabled. Teams that do not use xDS RBAC, or that enforce access control elsewhere, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["grpcjsxds"],"ptokens":["grpc","js","xds"],"labels":["cwe863","grpc","grpcjsxds","medium","node","npm","package","rbac","xds"],"campaign_type":null,"search_a":"'-128065':15A,23A '-2026':14A,22A '6742':19A 'appli':12A 'config':4A 'cve':13A,21A 'gg5j':18A 'ghsa':17A 'ghsa-gg5j':16A 'grpc/grpc-js':1A 'grpc/grpc-js-xds':24A 'overrid':3A 'rbac':2A 'resourc':9A 'rout':8A 'v827':20A 'virtualhost':6A","search_b":"'-863':26B 'allow':60B 'appli':49B 'block':80B 'broader':56B 'caller':64B 'cwe':25B 'deni':76B 'evalu':53B 'grpc':27B,29B 'grpc-js-xds':28B 'grpc/grpc-js-xds':37B 'handler':70B 'js':30B 'level':59B 'match':42B 'node':32B 'overrid':39B 'packag':33B 'polici':40B,61B,77B 'protect':68B 'rbac':34B,38B 'reach':66B 'resourc':46B 'rout':43B,74B 'route-specif':73B 'rpc':69B 'server':52B 'specif':75B 'top':58B 'top-level':57B 'unauthent':63B 'virtualhost':45B 'xds':31B,35B","search_c":"'-102':212C '-155':298C '-173':162C '-174':223C '-249':273C '-257':141C '/envoy.extensions.filters.http.rbac.v3.rbac':176C,353C '/envoy.extensions.filters.http.rbac.v3.rbacperroute':153C,385C '/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter.ts#l225-l257':157C '/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter/rbac-filter.ts#l167-l173':180C '/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#l169-l174':236C '/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#l225-l249':289C '/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#l99-l102':232C '1':448C '167':161C '225':140C 'accept':471C 'ack':115C,424C,442C 'action':355C,388C 'ad':324C 'allow':108C,343C,356C,359C,432C 'allow-ani':342C,358C 'appli':87C 'authent':465C 'base':464C 'broad':104C 'broader':301C 'concept':308C 'config':248C,278C,285C,349C,380C 'configur':468C 'contain':190C,330C 'control':100C,325C 'credenti':406C 'deliv':327C,367C 'deni':389C,392C,412C 'deny-ani':391C 'detail':128C 'document':214C 'entri':189C 'evalu':119C,299C 'even':185C 'expect':407C 'experiment':312C 'filter':144C,165C,207C,219C,247C,277C,284C,334C,379C 'filterconfig.typeurl':228C 'forward':372C 'github.com':156C,179C,231C,235C,288C 'github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter.ts#l225-l257':155C 'github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter/rbac-filter.ts#l167-l173':178C 'github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#l169-l174':234C 'github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#l225-l249':287C 'github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#l99-l102':230C 'grpc':310C,443C 'grpc/grpc-js-xds':84C,458C 'handler':321C,420C,438C,446C 'handlerouteconfigurationresourc':270C 'http':218C,333C 'httpfilter.name':253C 'impact':455C 'instead':205C 'interceptor':296C 'invoc':447C 'invok':400C 'key':201C,216C,249C,256C 'later':240C 'level':107C,126C,171C,304C,341C,431C 'listen':329C,439C 'look':142C,241C 'lookup':131C,182C 'map':199C,226C,264C 'match':91C,369C 'may':469C 'messag':135C,149C 'method':404C 'miss':261C 'name':208C,220C,335C,346C 'never':280C 'non':371C 'non-forward':370C 'null':184C 'observ':422C 'ok':445C 'ordinari':255C 'overrid':89C,113C,129C,134C,148C,197C,198C,238C,266C,292C,376C,454C,467C 'overrideconfigmap':209C 'packages/grpc-js-xds/src/http-filter.ts':139C 'packages/grpc-js-xds/src/http-filter/rbac-filter.ts':160C 'parseoverridefilterconfig':137C 'parseoverriderbacconfig':191C 'parser':130C 'per':246C,276C,283C,378C 'permiss':364C,397C 'plane':101C,326C 'polici':109C,127C,305C,345C,357C,390C,413C,433C 'princip':361C,394C 'proof':306C 'protect':319C,402C,419C,437C,450C 'rbac':172C,259C,295C,313C,332C,336C,347C,381C,386C,453C,463C 'rbac-bas':462C 'rbac-filter.ts:125':297C 'rbacperrout':88C 'reach':293C 'read':269C,274C,281C 'record':452C 'regist':163C,188C 'registri':145C 'reject':414C,477C 'request':473C 'resourc':95C,117C,426C 'respons':449C 'retain':427C 'return':183C 'rout':92C,237C,373C,410C 'route-specif':409C 'route.typed':275C 'routeconfigur':441C 'rpc':121C,416C 'rule':354C,387C 'run':315C,421C,435C 'secret':451C 'server.ts':193C 'server.ts:169':222C 'server.ts:225':272C 'server.ts:99':211C 'set':309C 'setup':158C 'silent':194C 'skip':195C 'sourc':154C,177C,229C,233C,286C 'specif':411C 'status':444C 'store':224C,263C 'stricter':112C 'summari':81C 'suppli':102C 'therefor':260C 'though':186C 'top':106C,125C,170C,303C,340C,430C 'top-level':105C,124C,169C,302C,339C,429C 'true':314C,363C,366C,396C,399C 'trust':98C 'type':136C,150C,173C,203C,245C,348C,350C,377C,382C 'type.googleapis.com':152C,175C,352C,384C 'type.googleapis.com/envoy.extensions.filters.http.rbac.v3.rbac':174C,351C 'type.googleapis.com/envoy.extensions.filters.http.rbac.v3.rbacperroute':151C,383C 'unari':320C,403C 'unintent':470C 'url':204C 'use':132C,146C,461C 'user':456C 'virtualhost':94C,265C 'virtualhost.typed':282C 'without':405C 'xds':99C,311C 'xdsserver':82C,114C,316C,423C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T22:55:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-gg5j-6742-v827","url":"https://github.com/advisories/GHSA-gg5j-6742-v827","severity":"medium","published_at":"2026-11-12T22:55:47+00:00","modified_at":"2026-11-12T22:55:48+00:00","first_seen_at":"2026-11-12T22:57:32+00:00","fetched_at":"2026-11-12T23:23:19+00:00","note":null}],"documents":[{"id":140058,"url":"https://api.github.com/repos/grpc/grpc-node/security-advisories/GHSA-gg5j-6742-v827","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":140059,"url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-gg5j-6742-v827","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":140060,"url":"https://github.com/grpc/grpc-node/commit/b8f3ced4d4699338dd33dc0f7b1d68d689a31d0e","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":140061,"url":"https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds@1.14.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}