Skip to main content
Griffin Technology PartnersGTP
MediumCVE-2026-37236updated

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control.

Published September 2, 2026Updated October 7, 2026

Source data

Overview

Full source title

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

The source does not supply a plain-text overview. Review the authoritative advisory for the full description.

Impact & technical details

A separate impact classification is not supplied in this record. See the source advisory.

CVSS base score
5.3 / 10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U

Highest base score supplied by MSRC for this record; the vector belongs to that score. Ratings can vary by product. Microsoft Important is displayed as High; Moderate is displayed as Medium.

Affected products

  • azl3 cert-manager 1.12.15-11 on Azure Linux 3.0
  • azl3 cert-manager 1.12.15-12 on Azure Linux 3.0
  • azl3 cf-cli 8.7.11-8 on Azure Linux 3.0
  • azl3 cf-cli 8.7.11-9 on Azure Linux 3.0
  • azl3 cloud-provider-kubevirt 0.5.1-6 on Azure Linux 3.0
  • azl3 cloud-provider-kubevirt 0.5.1-7 on Azure Linux 3.0
  • azl3 containerd2 2.2.4-6 on Azure Linux 3.0
  • azl3 containerd2 2.2.4-8 on Azure Linux 3.0
Show all 36 affected products
  • azl3 containerd2 2.3.4-1 on Azure Linux 3.0
  • azl3 cri-tools 1.32.0-7 on Azure Linux 3.0
  • azl3 cri-tools 1.32.0-8 on Azure Linux 3.0
  • azl3 docker-buildx 0.14.0-16 on Azure Linux 3.0
  • azl3 docker-buildx 0.14.0-17 on Azure Linux 3.0
  • azl3 docker-compose 2.27.0-13 on Azure Linux 3.0
  • azl3 docker-compose 2.27.0-14 on Azure Linux 3.0
  • azl3 etcd 3.5.33-1 on Azure Linux 3.0
  • azl3 flannel 0.24.2-29 on Azure Linux 3.0
  • azl3 flannel 0.24.2-31 on Azure Linux 3.0
  • azl3 flannel 0.24.2-32 on Azure Linux 3.0
  • azl3 keda 2.14.1-16 on Azure Linux 3.0
  • azl3 keda 2.14.1-18 on Azure Linux 3.0
  • azl3 keda 2.14.1-19 on Azure Linux 3.0
  • azl3 kube-vip-cloud-provider 0.0.10-7 on Azure Linux 3.0
  • azl3 kube-vip-cloud-provider 0.0.10-8 on Azure Linux 3.0
  • azl3 kubernetes 1.30.10-27 on Azure Linux 3.0
  • azl3 kubernetes 1.30.10-29 on Azure Linux 3.0
  • azl3 kubernetes 1.30.10-30 on Azure Linux 3.0
  • azl3 moby-containerd-cc 1.7.7-16 on Azure Linux 3.0
  • azl3 moby-containerd-cc 1.7.7-17 on Azure Linux 3.0
  • azl3 moby-engine 25.0.3-19 on Azure Linux 3.0
  • azl3 moby-engine 25.0.3-20 on Azure Linux 3.0
  • azl3 prometheus-adapter 0.12.0-10 on Azure Linux 3.0
  • azl3 prometheus-adapter 0.12.0-7 on Azure Linux 3.0
  • azl3 prometheus-adapter 0.12.0-9 on Azure Linux 3.0
  • azl3 telegraf 1.31.0-28 on Azure Linux 3.0
  • azl3 telegraf 1.31.0-31 on Azure Linux 3.0

Source guidance

Remediation

  • Release Notes

At least one Microsoft vendor-fix reference is available. Check each affected product for its applicable update, prerequisites, and supported version.

GTP recommendation · Rule-based guidance

Recommended next step

Review affected Microsoft products and apply the applicable security updates through your organization's normal patch-management process. Confirm availability and prerequisites in the Microsoft advisory.

Authoritative sources & updates

Findings and update information come from the linked publishers. GTP compiles the public record and provides the recommendation above. CVSS ratings shown here come from Microsoft. NVD references provide additional public context.

Managed by GTP?

Griffin Technology Partners managed customers may receive additional environment-specific security guidance and remediation assistance through their managed services relationship.

Contact GTPManaged Security Services

Security bulletins are provided for informational purposes and compiled from authoritative public sources. Vulnerability applicability varies by environment. Validate affected products, configuration, compatibility requirements, and vendor guidance before making production changes.