Search: CVE-2026-37236

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.8	EPSS 0.4%	CVE-2026-37236grpc-gateway · Insecure Direct Object Reference Critical9.8EPSS 0.4%2026-08-28CVE Database V5CVE-2026-37236 grpc-gateway version 2.28.0 has an incorrect access control vulnerability where the X-HTTP-Method-Override header is processed without restricting allowed HTTP methods. This allows an attacker to rewrite the HTTP method of a POST request with content type application/x-www-form-urlencoded to an arbitrary method before routing, potentially bypassing method-based access controls enforced by upstream proxies or WAFs. EPSS 0.4%Vulnerability CWE-639 #microsoft-security-response-ce	CVE Database V5	2026-08-28

Page 1 of 1 · 2 duplicate CVE records merged