TI-2026-35955 Aliases CVE-2026-48599 GHSA-mwr4-5g34-j5cq

Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding

HIGH 68CWE-639Published 2026-06-15 · Updated 2026-09-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body. In 'Elixir.GRPC.Server.Transcode':map_request/5 (lib/grpc/server/transcode.ex), all three clauses use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. A request such as GET /users/me/profile?user_id=victim (or a POST with {"user_id": "victim"} when body: "*") yields a decoded protobuf struct where the path-bound field carries the attacker-supplied value rather than the router-extracted value. Any handler that uses the path-bound field for authorization, multi-tenancy scoping, or ownership checks is silently bypassed. This issue affects grpc: from 0.8.0 before 1.0.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00339 27th percentileScored 2026-11-07

Fix Fixed grpc (elixir-grpc): 1.0.0grpc (Hex): 1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
elixir-grpc	grpc	0.8.0 to before 1.0.0	1.0.0	Patch available	CNA
—	grpc (Hex)	0.8.0 to before 1.0.0	1.0.0	Patch available	GHSA-mwr4-5g34-j5cq

grpc Vendorelixir-grpc Affected 0.8.0 to before 1.0.0 Fixed in 1.0.0 Patch available CNA
grpc (Hex) Vendor— Affected 0.8.0 to before 1.0.0 Fixed in 1.0.0 Patch available GHSA-mwr4-5g34-j5cq

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:elixir-grpc:grpc::::::::	—	—	—

cpe:2.3:a:elixir-grpc:grpc:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA grpc (elixir-grpc) Fixed in 1.0.0
Fix · GHSA-mwr4-5g34-j5cq grpc (Hex) Fixed in 1.0.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-06-15
elixir-grpc grpc 1.0.0
4 records Highest priority Priority HIGH 4 HIGH
Other records, highest priority first
- TI-2026-36118 Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpcPriority HIGH 81
- TI-2026-38512 grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1Priority HIGH 77
- TI-2026-36119 Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpcPriority HIGH 77
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-48599
2026-10-03 Alias added: GHSA-mwr4-5g34-j5cq

References

Patch 1

Fix commit 33b6a09 in elixir-grpc/grpc

Advisory 2

Other 6

TI-2026-36118 Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc CVSS 4.0CRITICAL 9.2
TI-2026-38512 grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1 CVSS 4.0HIGH 8.7
TI-2026-36119 Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc CVSS 4.0HIGH 8.7
TI-2026-86129 Unbounded streaming request buffering in grpc_server exhausts memory CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences