Threats Tagged 'cve-2026-48978'

grpc-gateway version 2.28.0 contains an incorrect access control vulnerability involving the processing of the X-HTTP-Method-Override header in ServeMux.ServeHTTP. The application does not properly restrict allowed HTTP methods, which can lead to unintended method overrides when handling POST requests with Content-Type application/x-www-form-urlencoded. This vulnerability is assigned CVE-2026-37236 and is rated medium severity. No patch or CVSS score is currently available, and no known exploits have been reported in the wild.

This security update for Helm addresses multiple vulnerabilities across several dependencies, including grpc-gateway, OpenTelemetry baggage parsing, oras-go registry authentication, and grpc-go components. The issues range from HTTP method override bypasses, denial of service via oversized inputs or crashes, credential exfiltration risks, to authorization bypasses and memory exhaustion. The update consolidates fixes into Helm version 3.21.1.

A security vulnerability (CVE-2026-48978) in Helm's oras.land/oras-go/v2/registry/remote/auth component allows a malicious registry to hijack the Bearer token realm and exfiltrate credentials and refresh tokens. This issue is resolved by updating Helm to version 3.21.2. The vulnerability is rated as low severity.

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.