CVE-2026-37236

A flaw was found in grpc-gateway up to v2.28.0. A remote attacker could exploit an incorrect access control vulnerability by sending a specially crafted POST request that includes the X-HTTP-Method-Override header. The application processes this header without restricting allowed methods, allowing the request method to be rewritten to an arbitrary attacker-supplied value before routing. This bypasses method-based access controls enforced by upstream proxies or Web Application Firewalls (WAFs), potentially leading to unauthorized actions or information disclosure.

This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires a deployment where upstream reverse proxies or perimeter filters enforce access control solely based on HTTP methods without stripping method-override headers. In typical Red Hat deployments, backend gRPC services enforce their own authentication and authorization controls, limiting an attacker's ability to execute unauthorized actions simply by tunneling rewritten request verbs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, configure any upstream proxies or Web Application Firewalls (WAFs) to strip or sanitize the X-HTTP-Method-Override header from incoming requests before they are forwarded to grpc-gateway applications. This prevents the grpc-gateway from processing the malicious header and bypassing access controls.