Threats tagged 'ghsa-gg5j-6742-v827'

A vulnerability in @grpc/grpc-js-xds (CVE-2026-128065) causes RBAC override configurations in VirtualHost and Route resources to be ignored. This results in the gRPC server applying a broad top-level ALLOW policy instead of stricter route-specific DENY overrides, potentially allowing unauthorized requests. The issue is due to incorrect filter configuration lookup and missing processing of VirtualHost overrides. A fix is available in version 1.14.2.