CVE-2026-37236

EUVD-2026-67776
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 35.84%
Debian logo
Debian Releases
Debian Product
Codename
golang-github-grpc-ecosystem-grpc-gateway
bookworm
postponed
forky
2.30.0-1
fixed
sid
2.30.0-1
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
golang-github-grpc-ecosystem-grpc-gateway
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
amazon-cloudwatch-agent
suse enterprise server 15 SP4
1.300069.0-150400.9.10.1
fixed
helm
suse enterprise sap 15 SP4
3.21.3-150000.1.96.1
fixed
suse enterprise sap 15 SP5
3.21.3-150000.1.96.1
fixed
suse enterprise sap 15 SP6
3.21.3-150000.1.96.1
fixed
suse enterprise sap 15 SP7
3.21.3-150000.1.96.1
fixed
suse enterprise server 15 SP4
3.21.3-150000.1.96.1
fixed
suse enterprise server 15 SP5
3.21.3-150000.1.96.1
fixed
suse enterprise server 15 SP6
3.21.3-150000.1.96.1
fixed
suse enterprise server 15 SP7
3.21.3-150000.1.96.1
fixed
helm-bash-completion
suse enterprise sap 15 SP4
3.21.3-150000.1.96.1
fixed
suse enterprise sap 15 SP5
3.21.3-150000.1.96.1
fixed
suse enterprise sap 15 SP6
3.21.3-150000.1.96.1
fixed
suse enterprise sap 15 SP7
3.21.3-150000.1.96.1
fixed
suse enterprise server 15 SP4
3.21.3-150000.1.96.1
fixed
suse enterprise server 15 SP5
3.21.3-150000.1.96.1
fixed
suse enterprise server 15 SP6
3.21.3-150000.1.96.1
fixed
suse enterprise server 15 SP7
3.21.3-150000.1.96.1
fixed
helm-zsh-completion
suse enterprise sap 15 SP4
3.21.3-150000.1.96.1
fixed
suse enterprise sap 15 SP5
3.21.3-150000.1.96.1
fixed
suse enterprise sap 15 SP6
3.21.3-150000.1.96.1
fixed
suse enterprise sap 15 SP7
3.21.3-150000.1.96.1
fixed
suse enterprise server 15 SP4
3.21.3-150000.1.96.1
fixed
suse enterprise server 15 SP5
3.21.3-150000.1.96.1
fixed
suse enterprise server 15 SP6
3.21.3-150000.1.96.1
fixed
suse enterprise server 15 SP7
3.21.3-150000.1.96.1
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
cert-manager
Azure Linux 3.0
0:1.12.15-14.azl3
fixed
cf-cli
Azure Linux 3.0
0:8.7.11-9.azl3
fixed
cloud-provider-kubevirt
Azure Linux 3.0
0:0.5.1-9.azl3
fixed
containerd2
Azure Linux 3.0
0:2.3.4-1.azl3
fixed
cri-tools
Azure Linux 3.0
0:1.32.0-8.azl3
fixed
docker-buildx
Azure Linux 3.0
0:0.14.0-17.azl3
fixed
docker-compose
Azure Linux 3.0
0:2.27.0-14.azl3
fixed
flannel
Azure Linux 3.0
0:0.24.2-32.azl3
fixed
keda
Azure Linux 3.0
0:2.14.1-19.azl3
fixed
kube-vip-cloud-provider
Azure Linux 3.0
0:0.0.10-10.azl3
fixed
kubernetes
Azure Linux 3.0
0:1.30.10-30.azl3
fixed
moby-containerd-cc
Azure Linux 3.0
0:1.7.7-17.azl3
fixed
moby-engine
Azure Linux 3.0
0:25.0.3-21.azl3
fixed
prometheus-adapter
Azure Linux 3.0
0:0.12.0-10.azl3
fixed
telegraf
Azure Linux 3.0
0:1.31.0-33.azl3
fixed
Common Weakness Enumeration
References
https://github.com/grpc-ecosystem/grpc-gateway
https://github.com/grpc-ecosystem/grpc-gateway/commit/72123cd4f32545f6e1376873f412dcdcbcf29acc
https://s00me00ne.com/cve/cve-2026-37236/