CVE-2026-128065

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-128065
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128065.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-128065
Aliases
Published
2026-11-12T22:45:27Z
Modified
2026-11-13T10:47:05Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied
Details

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is not registered under the override message type, override maps are stored under a type URL instead of the configured HTTP filter name, and VirtualHost override maps are not read. When experimental RBAC is enabled and a trusted xDS control plane supplies a broad top-level ALLOW policy with a stricter matching override, affected servers evaluate RPCs under the broad policy and can accept requests that should be denied. This issue is fixed in version 1.14.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128065.json"
}
References

Affected packages

Git / github.com/grpc/grpc-node

Affected ranges

Type
GIT
Repo
https://github.com/grpc/grpc-node
Events
Introduced
7db315d094b737f105fd7265dd69ab6d2a7bb2a1
Fixed
9eedd43da1ec61d5a4c79b0f037ef96c3367ba4f
Fixed
b8f3ced4d4699338dd33dc0f7b1d68d689a31d0e
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.14.0"
                },
                {
                    "fixed": "1.14.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "b8f3ced4d4699338dd33dc0f7b1d68d689a31d0e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

grpc@1.*
grpc@1.14.0
grpc@1.14.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128065.json"