CVE-2026-37236: grpc-gateway Auth Bypass Vulnerability

CVE-2026-37236 Overview

CVE-2026-37236 is an access control bypass vulnerability in grpc-gateway v2.28.0, a widely deployed Go library that translates RESTful HTTP APIs into gRPC calls. The ServeMux.ServeHTTP handler processes the X-HTTP-Method-Override header on POST requests using Content-Type: application/x-www-form-urlencoded without validating allowed methods. Attackers can rewrite the HTTP method to an arbitrary value before internal routing occurs. This defeats method-based access controls enforced by upstream web application firewalls (WAFs), reverse proxies, and API gateways, enabling attackers to reach protected DELETE, PUT, or PATCH endpoints through what appears to be a benign POST request.

Critical Impact
Unauthenticated network attackers can bypass method-restricted access controls to invoke privileged API operations, resulting in unauthorized data modification or deletion.

Affected Products

grpc-gateway v2.28.0
Applications embedding grpc-ecosystem/grpc-gateway/v2 runtime ServeMux
API gateways and microservices relying on upstream method-based access control

Discovery Timeline

2026-08-28 - CVE-2026-37236 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-37236

Vulnerability Analysis

The grpc-gateway runtime ServeMux implements HTTP-to-gRPC translation and includes a compatibility feature that honors the X-HTTP-Method-Override header. When a client sends a POST request with Content-Type: application/x-www-form-urlencoded and this header set, the mux rewrites r.Method to the header value before matching the request against registered routes. The rewrite occurs unconditionally, with no allow-list of methods, no configuration toggle in v2.28.0, and no verification that the caller has legitimate reason to override the method.

Upstream WAFs and reverse proxies typically enforce access policy on the wire method observed at the edge. Because the override happens after the request traverses these controls, edge policies protecting DELETE, PUT, or PATCH endpoints can be sidestepped by tunneling those verbs inside a POST body. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Root Cause

The root cause is trusting client-supplied HTTP metadata to redefine request semantics without policy enforcement. The ServeMux did not expose an option to disable the override, so integrators had no supported way to opt out even where the behavior conflicted with their security model.

Attack Vector

An unauthenticated remote attacker crafts a POST request to a grpc-gateway endpoint with Content-Type: application/x-www-form-urlencoded and an X-HTTP-Method-Override: DELETE (or PUT, PATCH) header. The edge proxy sees POST and permits the request. The gateway rewrites the method and routes the call to the DELETE handler, executing the privileged operation.

// Security patch in runtime/mux.go - Add WithDisableHTTPMethodOverride ServeMux option (#6447)
 	streamErrorHandler        StreamErrorHandlerFunc
 	routingErrorHandler       RoutingErrorHandlerFunc
 	disablePathLengthFallback bool
+	disableHTTPMethodOverride bool
 	unescapingMode            UnescapingMode
 	writeContentLength        bool
 	disableChunkedEncoding    bool

Source: GitHub Commit 72123cd4f

Detection Methods for CVE-2026-37236

Indicators of Compromise

HTTP requests to grpc-gateway endpoints containing the X-HTTP-Method-Override header, especially with values DELETE, PUT, or PATCH
POST requests with Content-Type: application/x-www-form-urlencoded targeting APIs that normally accept JSON
Application logs showing DELETE, PUT, or PATCH handlers invoked while access logs record only POST at the proxy layer

Detection Strategies

Correlate edge proxy access logs with backend application logs to identify method mismatches between the observed wire method and the executed handler
Deploy WAF or reverse proxy rules that flag or strip X-HTTP-Method-Override headers on inbound traffic
Instrument grpc-gateway middleware to record the pre-override and post-override method for every request

Monitoring Recommendations

Alert on any privileged state-changing operation whose upstream request method was POST but whose backend method was DELETE or PUT
Track anomalous POST volume against endpoints that historically receive GET or PUT traffic
Include grpc-gateway version inventory in software composition analysis (SCA) reports to identify exposure to v2.28.0

How to Mitigate CVE-2026-37236

Immediate Actions Required

Upgrade grpc-gateway past v2.28.0 to a release containing the WithDisableHTTPMethodOverride option and apply that option in ServeMux initialization
Configure edge proxies and WAFs to strip or block the X-HTTP-Method-Override header from untrusted clients
Audit application logs for prior use of the header and review any state-changing operations invoked through it

Patch Information

The fix is committed to the grpc-ecosystem/grpc-gateway repository in commit 72123cd4f, which introduces the disableHTTPMethodOverride field on ServeMux and the corresponding WithDisableHTTPMethodOverride functional option. Consult the grpc-gateway repository for released versions containing this change.

Workarounds

Deploy a reverse proxy rule that removes the X-HTTP-Method-Override header before requests reach the gateway
Reject POST requests with Content-Type: application/x-www-form-urlencoded at the edge for APIs that only accept JSON payloads
Enforce authorization checks inside gRPC service handlers rather than relying solely on HTTP method policy at the proxy

bash

# Nginx example: strip the override header from all inbound requests
location / {
    proxy_set_header X-HTTP-Method-Override "";
    proxy_pass http://grpc_gateway_upstream;
}