Critical severity9.8NVD Advisory· Published Aug 28, 2026· Updated Sep 8, 2026
CVE-2026-37236
CVE-2026-37236
Description
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
12- Range: <2.28.0
- osv-coords11 versionspkg:rpm/opensuse/alloy&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/amazon-cloudwatch-agent&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/distribution&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/distribution&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/hauler&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/hauler&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/helm&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/helm&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/helm3&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/trivy&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/trivy&distro=openSUSE%20Tumbleweed
< 1.19.2-1.1+ 10 more
- (no CPE)range: < 1.19.2-1.1
- (no CPE)range: < 1.300072.0-1.1
- (no CPE)range: < 3.1.1-160000.3.1
- (no CPE)range: < 3.1.1-6.1
- (no CPE)range: < 2.1.0-bp160.1.1
- (no CPE)range: < 2.1.0-1.1
- (no CPE)range: < 3.21.3-160000.2.1
- (no CPE)range: < 4.2.4-3.1
- (no CPE)range: < 3.21.3-7.1
- (no CPE)range: < 0.74.0-160000.2.1
- (no CPE)range: < 0.74.0-2.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.