9.8

CVE-2026-37236: golang-github-grpc-ecosystem-grpc-gateway

Deferred
AliasesUBUNTU-CVE-2026-37236DEBIAN-CVE-2026-37236openSUSE-SU-2026:11669-1
Published 28-08-2026Last modified 02-09-2026

Vulnerability summary

CVE-2026-37236 is a critical (CVSS 9.8) vulnerability in golang-github-grpc-ecosystem-grpc-gateway. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 37.7% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.43%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 21 · Related 21
OPENSUSE-SU-2026:11667-1OPENSUSE-SU-2026:11676-1OPENSUSE-SU-2026:11697-1OPENSUSE-SU-2026:11718-1OPENSUSE-SU-2026:11803-1OPENSUSE-SU-2026:11828-1

Timeline

  1. 28-08-2026
    PublishedVulnerability first disclosed.
  2. 02-09-2026
    Last modifiedVulnerability information updated.

Description

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.43% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard6 products
  • argo-workflow-controller-4.1All versions (No fix recorded)
  • argo-workflow-controller-fips-4.1All versions (No fix recorded)
  • argo-workflow-executor-4.1All versions (No fix recorded)
  • argo-workflow-executor-fips-4.1All versions (No fix recorded)
  • argo-workflows-4.1All versions (No fix recorded)
Debian1 product
  • golang-github-grpc-ecosystem-grpc-gatewayAll versions (No fix recorded) | < 2.30.0-1
Opensuse1 product
  • helm3&distro=openSUSE Tumbleweed< 3.21.3-7.1
Ubuntu1 product
  • golang-github-grpc-ecosystem-grpc-gatewayAll versions (No fix recorded)

4 vendors · 9 products

References

9 links