CVE-2026-37236: grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
A security issue in grpc-gateway version 2.28.0 allows attackers to bypass method-based access controls by manipulating a special HTTP header. This happens because the application does not limit which HTTP methods can be set via this header, potentially letting attackers use methods not allowed by upstream protections.
Published 11/8/2026, 7:00:00 amVerified 11/9/2026, 3:02:58 pmRevision 1
In plain language
What this advisory means
A security issue in grpc-gateway version 2.28.0 allows attackers to bypass method-based access controls by manipulating a special HTTP header. This happens because the application does not limit which HTTP methods can be set via this header, potentially letting attackers use methods not allowed by upstream protections.
Technical explanation
How the issue affects the environment
In grpc-gateway v2.28.0, the ServeMux.ServeHTTP function processes the X-HTTP-Method-Override header in POST requests with content type application/x-www-form-urlencoded. The code rewrites the HTTP method to an arbitrary value supplied by the attacker, without restricting allowed methods. This enables bypass of method-based access control policies enforced by upstream proxies or web application firewalls, as the original HTTP POST method is effectively overridden.
Operational impact
Why teams should care
This vulnerability can allow attackers to circumvent important security controls that rely on HTTP method restrictions, potentially leading to unauthorized actions on the web service. This bypass can diminish the effectiveness of upstream security devices like proxies and WAFs that enforce access control based on HTTP methods.
Immediate action
Users should refer to the Microsoft Security Update Guide for applicability and details on updates or patches that mitigate this vulnerability.
Affected and fixed releases
Affected versionsv2.28.0
Fixed versionsConfirm in the official vendor advisory
Temporary risk reduction
No separate workaround was supplied in the source feed. Use the official vendor advisory before changing production controls.
Evidence and validation checklist
Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-37236
Description of method override handling vulnerability in grpc-gateway ServeMux.ServeHTTP
Details on bypassing method-based access controls on POST requests with X-HTTP-Method-Override header.
Reference to Microsoft Security Update Guide for remediation procedures.
Authoritative reference
Microsoft Security Response Center
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.
