grpc-gateway CVE-2026-37236

Exploitation requires the gateway to sit behind an upstream WAF or reverse proxy that enforces method-based access controls, and requires the request to be a POST with Content-Type: application/x-www-form-urlencoded so the path-length-fallback branch that reads X-HTTP-Method-Override is entered; the target verb's handler must also exist and be routable in the gateway. Limiting factors: the bug only confers advantage when perimeter method filtering is the control being bypassed - deployments with no method-filtering proxy, or that already strip the header, or that enforce authorization inside the service, are effectively unaffected, and no authentication is needed but the override path is gated on the specific POST + form-urlencoded content type.

The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world risk: the vulnerability only yields a security benefit to the attacker when an upstream WAF or reverse proxy is actually enforcing method-based access controls in front of the gateway, which is a specific deployment condition rather than a default one, arguing for AC:H and impacts well below C:H/I:H/A:H. The concrete impact is reaching HTTP handlers (e.g. DELETE/PUT) the perimeter intended to block - primarily an integrity concern, with confidentiality/availability effects contingent on which handlers become reachable. Corroborating signals point the same way: EPSS is only 0.18% (7th percentile), not in CISA KEV, and no public PoC is identified, so this is a genuine hardening issue rather than a mass-exploitation emergency. That said, where such a proxy allow-list is the sole control on state-changing endpoints the bypass can be serious, so an operator matching that pattern - even a mid-sized municipal IT team running a gateway behind a method-filtering WAF - should schedule the update rather than defer it, while purely gateway-native RBAC deployments are largely unaffected.

An organization fronts its grpc-gateway with a WAF configured to allow only POST to a sensitive resource path. An unauthenticated attacker sends a POST with Content-Type application/x-www-form-urlencoded and the header X-HTTP-Method-Override: DELETE; the WAF sees an allowed POST and passes it, but the gateway rewrites the method and invokes the DELETE handler, deleting the resource. No public PoC is identified, but the technique is straightforward to reproduce from the description.