CVE-2026-37236 Security feature bypass in n/a
Attackers can bypass method-based access controls in grpc-gateway by using the X-HTTP-Method-Override header to rewrite request methods.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-37236?
CVE-2026-37236 is a critical vulnerability in n/a, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
Weakness: CWE-639
Which versions are affected by CVE-2026-37236?
Linux distribution packages (1)
helm3 openSUSE:Tumbleweed | All versions | 3.21.3-7.1 |
How do I fix CVE-2026-37236?
Upgrade to a fixed version.
Is CVE-2026-37236 being exploited?
There is no known exploitation of CVE-2026-37236 in the wild and no public exploit code.
Sources
Also known as AZL-98253, AZL-98256, AZL-98343, AZL-98346, AZL-98349, AZL-98352 and 17 more.