Skip to content
Fencer Vulns
critical 9.8

CVE-2026-37236 json

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control.

published 2026-08-28 2 mo ago modified 2026-09-08 2 mo ago also EUVD-2026-67776

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

Patch / fix

  • golang-github-grpc-ecosystem-grpc-gateway Debian 14 2.30.0-1

debian advisories DEBIAN-CVE-2026-37236

  • alloy SLES for SAP applications 16.0, SLES 16.0 1.19.2-160000.1.1
  • alloy SLE Module for Basesystem 15 SP7 1.19.2-150700.15.29.1
  • distribution SLES 16.0, SLES for SAP applications 16.0 3.1.1-160000.3.1
  • helm SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +10 more 3.21.3-150000.1.96.1
  • helm SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.21.3-160000.2.1
  • amazon-cloudwatch-agent SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +1 more 1.300069.0-150400.9.10.1
  • helm Linux Micro 6.1 3.21.3-slfo.1.1_2.1
  • helm Linux Micro 6.0 3.21.3-2.1

suse advisories SUSE-SU-2026:24148-1SUSE-SU-2026:4408-1SUSE-SU-2026:23852-1SUSE-SU-2026:23864-1SUSE-SU-2026:4175-1SUSE-SU-2026:23506-1

  • alloy openSUSE Leap 16.0 1.19.2-160000.1.1
  • distribution openSUSE Leap 16.0 3.1.1-160000.3.1
  • amazon-cloudwatch-agent openSUSE Tumbleweed 1.300072.0-1.1
  • alloy openSUSE Tumbleweed 1.19.2-1.1
  • helm openSUSE Leap 16.0 3.21.3-160000.2.1
  • helm openSUSE Tumbleweed 4.2.4-3.1
  • trivy openSUSE Leap 16.0 0.74.0-160000.2.1
  • distribution openSUSE Tumbleweed 3.1.1-6.1

opensuse advisories openSUSE-SU-2026:22032-1openSUSE-SU-2026:21898-1openSUSE-SU-2026:11828-1openSUSE-SU-2026:11803-1openSUSE-SU-2026:21809-1openSUSE-SU-2026:11718-1

  • cert-manager Azure Linux 3.0 1.12.15-14
  • cf-cli Azure Linux 3.0 8.7.11-9
  • cloud-provider-kubevirt Azure Linux 3.0 0.5.1-9
  • containerd2 Azure Linux 3.0 2.3.4-1
  • cri-tools Azure Linux 3.0 1.32.0-8
  • docker-buildx Azure Linux 3.0 0.14.0-17
  • docker-compose Azure Linux 3.0 2.27.0-14
  • etcd Azure Linux 3.0 3.5.35-1

azure linux advisories AZL-98343AZL-98346AZL-98349AZL-98352AZL-98355AZL-98358

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-37236 updated cvss 5.4

github.com/grpc-ecosystem/grpc-gateway: github.com/grpc-ecosystem/grpc-gateway/v2: grpc-gateway: Access control bypass via X-HTTP-Method-Override header

  • Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-grafana-rhel9 Red Hat OpenShift Serverless openshift-serverless-1/logic-rhel9-operator, openshift-serverless-1/kn-plugin-event-sender-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/observatorium-rhel9
    affected: workaround, no fix available
  • Red Hat Ceph Storage 5 rhceph/snmp-notifier-rhel8 Red Hat Ceph Storage 6 rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 7 rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 8 rhceph/snmp-notifier-rhel9 Red Hat Ceph Storage 9 rhceph/snmp-notifier-rhel10
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-ml-pipelines-driver-rhel9, rhoai/odh-ml-pipelines-launcher-rhel9, rhoai/odh-ml-pipelines-api-server-v2-rhel9, rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9, rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9, rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, +1 more
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 cri-tools, openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, openshift-kube-apiserver, +27 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 5 openshift5/ose-oauth-server-rhel9, openshift5/ose-kube-rbac-proxy-rhel9, openshift5/ose-gcp-cloud-controller-manager-rhel9, openshift5/ose-azure-cluster-api-controllers-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps microshift-gitops 1.19.2-36.el9, openshift-gitops-1/argocd-rhel8, openshift-gitops-argocd-cli 1.19.2-36.el9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/acm-grafana-rhel9 1792865487
    fixed: vendor fix RHSA-2026:92307
  • Red Hat OpenShift GitOps 1.20 openshift-gitops-1/argocd-rhel9 1793853136
    fixed: vendor fix RHSA-2026:95610
show 10 more
  • Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9
    not affected: component not present
  • Red Hat Migration Toolkit for Applications 8 mta/mta-hub-rhel9
    not affected: vulnerable code not present
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/prometheus-rhel9, rhacm2/acm-must-gather-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/thanos-rhel9 1792872550, rhacm2/acm-cli-rhel9 1792972427, rhacm2/console-rhel9 1792883111, rhacm2/prometheus-rhel9 1792853139, rhacm2/acm-search-v2-rhel9 1792847370, rhacm2/node-exporter-rhel9 1792872412, +37 more Red Hat Ansible Automation Platform 2 ansible-automation-platform/platform-operator-bundle
    not affected: vulnerable code not present
  • Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more
    not affected: component not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-model-registry-rhel9, rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift Container Platform 4 microshift, microshift-olm, microshift-sriov, microshift-multus, microshift-selinux, openshift4/ose-etcd, +87 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 5 openshift, microshift, openshift5/ose-hyperkube-rhel9, openshift5/ose-openshift-apiserver-rhel9, openshift5/ose-azure-cloud-controller-manager-rhel9
    not affected: component not present
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-agent-rhel8, openshift-gitops-1/argocd-agent-rhel9, openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argo-rollouts-rhel9, openshift-gitops-1/gitops-rhel9-operator, openshift-gitops-1/argocd-image-updater-rhel8, +1 more
    not affected: vulnerable code cannot be controlled by adversary
  • Red Hat OpenShift GitOps 1.20 openshift-gitops-1/dex-rhel9 1793840564, openshift-gitops-1/gitops-rhel9 1793840647, openshift-gitops-1/must-gather-rhel9 1793840205, openshift-gitops-1/argocd-agent-rhel9 1793840250, openshift-gitops-1/argo-rollouts-rhel9 1793840568, openshift-gitops-1/console-plugin-rhel9 1793841434, +4 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cluster-network-addons-operator-rhel9 Red Hat OpenStack Platform 16.2 etcd Red Hat OpenStack Platform 17.1 etcd Red Hat OpenStack Platform 18.0 etcd, rhoso-operators/openstack-operator-bundle
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.