What is the CVSS score of EUVD-2026-67776?

EUVD-2026-67776 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of grpc-gateway are affected by EUVD-2026-67776?

grpc-gateway v2.28.0 contains a critical authentication bypass allowing remote attackers to override HTTP methods via header injection, circumventing access controls enforced by firewalls and reverse…. A patch is available.

How to fix or mitigate EUVD-2026-67776?

Within 24 hours, identify all systems running grpc-gateway v2.28.0 and review access logs for X-HTTP-Method-Override header patterns or anomalous method sequences. Within 7 days, deploy WAF or proxy rules to strip and block the X-HTTP-Method-Override header, implement application-level HTTP method validation independent of proxy enforcement, and monitor for exploitation attempts. Within 30 days, upgrade to grpc-gateway 2.29.0 or later when the vendor releases a patched version, and review all method-based access control policies to add defense-in-depth at the application layer.

grpc-gateway EUVD-2026-67776

| CVE-2026-37236 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-28 mitre

GHSA-6gx8-r37x-4vw8

Authentication Bypass Red Hat N A Suse

Critical

Disputed · 9.8 Vendor: mitre

Severity by source

Sources disagree (Medium–Critical)

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Network unauthenticated, but AC:H because it only pays off behind a method-filtering proxy; impact is chiefly reaching restricted (often state-changing) handlers, so I:H, C:L, A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Red Hat

5.4 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Sep 02, 2026 - 21:36 vuln.today

Analysis Generated

Sep 02, 2026 - 21:36 vuln.today

CVSS changed

Sep 02, 2026 - 19:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 28, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 28, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

AnalysisAI

HTTP method confusion in grpc-ecosystem's grpc-gateway v2.28.0 lets remote clients bypass method-based access controls enforced by an upstream WAF or reverse proxy. The ServeMux honors a client-supplied X-HTTP-Method-Override header on POST requests carrying Content-Type application/x-www-form-urlencoded, rewriting the request method to any attacker-chosen verb (e.g. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires the gateway to sit behind an upstream WAF or reverse proxy that enforces method-based access controls, and requires the request to be a POST with Content-Type: application/x-www-form-urlencoded so the path-length-fallback branch that reads X-HTTP-Method-Override is entered; the target verb's handler must also exist and be routable in the gateway. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) overstates real-world risk: the vulnerability only yields a security benefit to the attacker when an upstream WAF or reverse proxy is actually enforcing method-based access controls in front of the gateway, which is a specific deployment condition rather than a default one, arguing for AC:H and impacts well below C:H/I:H/A:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Update to a grpc-gateway release that includes fix commit 72123cd4f32545f6e1376873f412dcdcbcf29acc (the patched version tag was not asserted in the structured feed - confirm the exact release from the repository tags before pinning). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all systems running grpc-gateway v2.28.0 and review access logs for X-HTTP-Method-Override header patterns or anomalous method sequences. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in N A

View all

CVE-2024-51092 CRITICAL Act Now POC

9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr

CVE-2025-15684 MEDIUM This Month POC

5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han

CVE-2024-45257 HIGH Act Now POC

7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi

CVE-2025-15687 LOW Monitor POC

2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc

CVE-2025-15686 LOW Monitor POC

2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula

CVE-2025-67888 HIGH Act Now POC

7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH Act Now POC

7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(

CVE-2026-38360 CRITICAL Act Now POC

9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti

CVE-2026-30623 CRITICAL Act Now POC

9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr

CVE-2026-67917 CRITICAL Act Now POC

9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg

CVE-2026-75337 CRITICAL Act Now POC

9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ

CVE-2026-31072 CRITICAL Act Now POC

9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all

CVE-2024-50483 CRITICAL

9.8

CVE-2026-55255 HIGH POC

8.4

CVE-2025-3605 CRITICAL POC

9.8

CVE-2022-3805 HIGH POC

8.6

CVE-2025-5947 CRITICAL POC

9.8

CVE-2020-36923 CRITICAL POC

9.8

CVE-2025-14998 CRITICAL POC

9.8

CVE-2023-3048 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Server 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Server 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Linux Enterprise Module for Public Cloud 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Linux Enterprise Module for Public Cloud 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Micro 6.0	Fixed

EUVD-2026-67776 vulnerability details – vuln.today

Back

grpc-gateway EUVD-2026-67776

Severity by source

CVSS VectorVendor: mitre

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in N A

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code