Improper access control in grpc-go - #VU144259
Published: August 19, 2026
Vulnerability identifier: #VU144259
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization checks.
The vulnerability exists due to improper access control in the xDS RBAC authorization engine when translating xDS RBAC policies containing unsupported Metadata or RequestedServerName matchers. A remote attacker can supply or rely on crafted policy conditions to bypass authorization checks.
If the authorization policy relies on these matchers for access control, unsupported rules may be treated as no-ops and logical NOT, OR, or AND nesting can alter boolean policy evaluation.
Affected software
grpc-go
Remediation
Install security update from vendor's website.
grpc-go - update to 1.82.1