---
id: "CVE-2026-128065"
page: "https://infrastack.ai/live/CVE-2026-128065"
kind: "vulnerability"
aliases: ["CVE-2026-128065", "GHSA-gg5j-6742-v827"]
title: "@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@grpc/grpc-js-xds", "fixed": ["1.14.2"], "affected": ">= 1.14.0, < 1.14.2", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-863", "grpc", "grpc-js-xds", "node", "package", "rbac", "xds"]
not_affected_if: ["auth-enforced-elsewhere", "default-config", "xds-rbac-unused"]
published_at: "2026-11-12T22:55:47+00:00"
first_seen_at: "2026-11-12T22:57:32+00:00"
updated_at: "2026-11-12T22:59:07+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-gg5j-6742-v827", "first_seen_at": "2026-11-12T22:57:32+00:00"}]
exploit_sources: []
---

# @grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied

Link for people: https://infrastack.ai/live/CVE-2026-128065 (this .md is for agents)

In @grpc/grpc-js-xds, RBAC override policies from matching Route or VirtualHost resources are not applied, so the server evaluates only the broader top-level ALLOW policy. An unauthenticated caller can reach a protected RPC handler that a route-specific DENY policy should have blocked.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@grpc/grpc-js-xds affected >= 1.14.0, < 1.14.2 fixed 1.14.2

## How to check

- Check the installed version with `npm ls @grpc/grpc-js-xds`.
- Look for RBAC HTTP filters delivered via xDS with `typed_per_filter_config` overrides, and whether `GRPC_XDS_EXPERIMENTAL_RBAC=true` is set.

## Fix

- `@grpc/grpc-js-xds` `1.14.2`

## Timeline

- 2026-11-12T22:57:32+00:00 ghsa https://github.com/advisories/GHSA-gg5j-6742-v827

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/grpc/grpc-node/security-advisories/GHSA-gg5j-6742-v827
- [advisory] Maintainer's advisory: github.com https://github.com/grpc/grpc-node/security/advisories/GHSA-gg5j-6742-v827
- [fix] Patch: github.com https://github.com/grpc/grpc-node/commit/b8f3ced4d4699338dd33dc0f7b1d68d689a31d0e
- [fix] Release: github.com https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds@1.14.2

## From the sources

### Summary

`XdsServer` in `@grpc/grpc-js-xds` does not apply `RBACPerRoute` overrides from matching Route or VirtualHost resources. When a trusted xDS control plane supplies a broad top-level ALLOW policy and a stricter override, `XdsServer` ACKs the resources but evaluates the RPC under the top-level policy.

### Details

### Override parser lookup uses the override message type

`parseOverrideFilterConfig()` in packages/grpc-js-xds/src/http-filter.ts:225-257 looks up FILTER_REGISTRY using the override message type:

`type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute`
Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter.ts#L225-L257

`setup()` in packages/grpc-js-xds/src/http-filter/rbac-filter.ts:167-173 registers the filter only under the top-level RBAC type:

`type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC`
Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter/rbac-filter.ts#L167-L173

The lookup returns null even though the registered entry contains `parseOverrideRbacConfig()`, and server.ts silently skips the override.

### Override maps are keyed by type URL instead of filter name

`overrideConfigMaps` in server.ts:99-102 is documented as keyed by HTTP filter name, but server.ts:169-174 stores each map under `filterConfig.typeUrl`.

Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L99-L102

Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L169-L174

Route overrides are later looked up by their `typed_per_filter_config` key, which is the `HttpFilter.name`. An ordinary key such as rbac therefore misses the stored map.

### VirtualHost overrides are not read

`handleRouteConfigurationResource()` in server.ts:225-249 reads `route.typed_per_filter_config` but never reads `virtualHost.typed_per_filter_config`.

Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L225-L249

When no override reaches the RBAC interceptor, rbac-filter.ts:125-155 evaluates the broader top-level policy.

### Proof of concept

Set:
```
GRPC_XDS_EXPERIMENTAL_RBAC=true
```

Run `XdsServer` with a protected unary handler.

Have the ADS control plane deliver a Listener containing an RBAC HTTP filter named rbac with a top-level ALLOW-any policy:

```
name: rbac
typed_config:
  "@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    action: ALLOW
    policies:
      allow-any:
        principals: [{ any: true }]
        permissions: [{ any: true }]
```

Deliver a matching non-forwarding route with this override:

```
typed_per_filter_config:
  rbac:
    "@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute
    rbac:
      rules:
        action: DENY
        policies:
          deny-any:
            principals: [{ any: true }]
            permissions: [{ any: true }]
```

Invoke the protected unary method without credentials.

Expected: The route-specific DENY policy rejects the RPC before the protected handler runs.

Observed: `XdsServer` ACKs the resources, retains the top-level ALLOW policy, and runs the protected handler.

```
Listener and RouteConfiguration: ACKED
gRPC status: OK
handler invocations: 1
response: PROTECTED_SECRET_RECORD_RBAC_OVERRIDE
```

### Impact

Users of `@grpc/grpc-js-xds` who are using RBAC-based authentication with override configurations may unintentionally accept some requests that should be rejected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_