CVE-2026-37236

grpc-gateway v2.28.0 processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting which methods it may be set to, an incorrect access control flaw (CWE-639). An unauthenticated attacker triggers it by sending a POST request with Content-Type application/x-www-form-urlencoded and an attacker-chosen X-HTTP-Method-Override value, causing the mux to rewrite the request method to that arbitrary value before routing. The attacker gains the ability to make requests appear as other HTTP methods, bypassing method-based access controls enforced by upstream reverse proxies or WAFs — for example, reaching handlers that a proxy restricts to GET or POST by overriding the method to DELETE or PUT. Deployments of grpc-gateway v2.28.0 that sit behind a proxy or WAF applying method-based rules are affected, while services without such front-door controls are largely unaffected; the flaw is nonetheless rated Critical (CVSS 3.1: 9.8). No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates a 0.4% probability of exploitation within 30 days (37th percentile), so no exploitation is currently known.

What to do: Until a patched release is published (the advisory names no fixed version), strip or validate the X-HTTP-Method-Override header at edge proxies/WAFs and consider blocking POST requests with Content-Type application/x-www-form-urlencoded that carry the header. Audit whether your fronting proxies or WAFs enforce method-based access rules in front of grpc-gateway services, and avoid relying on method-based ACLs alone for access control. Check the grpc-ecosystem grpc-gateway repository for an official fixed version before upgrading.