CVE-2026-37236: n/a
Description
grpc-gateway version 2.28.0 has an incorrect access control vulnerability where the X-HTTP-Method-Override header is processed without restricting allowed HTTP methods. This allows an attacker to rewrite the HTTP method of a POST request with content type application/x-www-form-urlencoded to an arbitrary method before routing, potentially bypassing method-based access controls enforced by upstream proxies or WAFs.
CVSS v3.1
Score 9.8critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The grpc-gateway v2.28.0 incorrectly processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP by not restricting which HTTP methods can be overridden. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an attacker-supplied value before routing. This behavior enables bypassing method-based access controls that might be enforced by upstream proxies or web application firewalls, leading to unauthorized access or actions.
Potential Impact
An attacker can bypass method-based access controls by manipulating the X-HTTP-Method-Override header, potentially gaining unauthorized access or performing unauthorized actions. The vulnerability has a CVSS score of 9.8 (critical), indicating high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or validate the X-HTTP-Method-Override header at upstream proxies or WAFs to prevent arbitrary method overrides.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-04-06T00:00:00.000Z
- State
- PUBLISHED
Threat ID: 6a91ab59acd9273b490abef5
Added to database: 08/28/2026, 15:38:01 UTC
Last enriched: 09/17/2026, 02:50:34 UTC
Last updated: 10/12/2026, 18:48:19 UTC
Views: 103
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.