CVE-2026-37236: 
Grafana vulnerability analysis and mitigation

CVE-2026-37236 is an authorization bypass vulnerability in grpc-gateway v2.28.0 caused by unrestricted processing of the X-HTTP-Method-Override HTTP header. When a POST request with Content-Type: application/x-www-form-urlencoded includes this header, the ServeMux.ServeHTTP handler rewrites the request method to an arbitrary attacker-supplied value before routing, allowing bypass of method-based access controls enforced by upstream proxies or WAFs. The vulnerability was published on August 28, 2026, with a patch released shortly after. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Microsoft MSRC). Affected downstream products include multiple Azure Linux 3 (AZL3) packages that bundle grpc-gateway, such as azl3_kubernetes_1.30.10-29, azl3_cert-manager_1.12.15-12, and others (Microsoft MSRC).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the ServeMux.ServeHTTP method in grpc-gateway's runtime package unconditionally reads the X-HTTP-Method-Override header and rewrites the HTTP method to whatever value the client supplies, without any allowlist or restriction on permitted methods. This behavior is triggered when the request uses Content-Type: application/x-www-form-urlencoded (the "path length fallback" code path), which was originally designed to allow HTML forms to invoke non-GET/POST methods. An unauthenticated remote attacker can craft a POST request with X-HTTP-Method-Override: DELETE (or any other method), causing the gateway to route the request to the DELETE handler while the upstream WAF or proxy only observes a POST — a classic HTTP method confusion attack. The fix, committed at grpc-gateway commit 72123cd, introduces a new WithDisableHTTPMethodOverride() ServeMuxOption that sets a disableHTTPMethodOverride flag, causing the override logic to be skipped while leaving the path-length fallback intact.

A successful exploit allows an unauthenticated attacker to invoke any HTTP method (e.g., DELETE, PUT, PATCH) on backend gRPC-Gateway endpoints that are nominally protected by method-based controls in an upstream WAF or reverse proxy. This can result in unauthorized data modification or deletion (integrity impact), exposure of sensitive resources accessible only via restricted methods (confidentiality impact), and potential service disruption (availability impact) — all rated HIGH by NVD. Because grpc-gateway is embedded in widely deployed cloud-native components (Kubernetes, cert-manager, containerd, Helm, etc.), the blast radius extends to infrastructure management planes where method-level access control is a primary security boundary (GitHub Advisory, GitHub Commit).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is rated automatable (no user interaction required) with network-level access and no authentication preconditions, making it trivially exploitable once an attacker identifies a vulnerable endpoint. The EPSS score is approximately 0.176% (0.00176), indicating a currently low but non-negligible probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report. The vulnerability was discovered and reported by security researcher Mariusz Maik (GitHub Commit).

1. Reconnaissance: Identify services exposing a gRPC-Gateway HTTP endpoint (version 2.28.0) using tools like Shodan, Censys, or manual probing. Look for JSON/REST APIs that proxy to gRPC backends, particularly those behind WAFs or reverse proxies enforcing HTTP method restrictions.
2. Identify protected endpoints: Map available API endpoints and determine which HTTP methods are blocked by the upstream WAF/proxy (e.g., DELETE or PUT requests returning 403/405 from the WAF).
3. Craft the bypass request: Construct a POST request to the target endpoint with:
   • Content-Type: application/x-www-form-urlencoded (to trigger the path-length fallback code path)
   • X-HTTP-Method-Override: DELETE (or any restricted method to invoke)
   • An empty or minimal request body
4. Send the request: The WAF/proxy observes a POST request and permits it. The grpc-gateway ServeMux.ServeHTTP reads the X-HTTP-Method-Override header and rewrites the method to DELETE before routing.
5. Achieve unauthorized action: The backend gRPC handler for the DELETE route processes the request, performing the restricted operation (e.g., deleting a resource) without the attacker ever sending a DELETE request that the WAF would have blocked (GitHub Commit, GitHub Advisory).

• Network: Unexpected POST requests to gRPC-Gateway endpoints that result in state changes (deletions, updates) normally associated with other HTTP methods; POST requests with Content-Type: application/x-www-form-urlencoded to REST API paths that do not normally accept form-encoded data.
• HTTP Headers: Presence of X-HTTP-Method-Override header in inbound POST requests to the gateway, especially with values such as DELETE, PUT, or PATCH.
• Logs: Application/access logs showing POST requests that triggered handler logic for non-POST gRPC methods (e.g., resource deletion events correlated with POST log entries); WAF logs showing allowed POST requests followed by unexpected backend resource modifications.
• Application Behavior: Unexpected resource deletions, modifications, or privilege escalations in services backed by grpc-gateway that cannot be attributed to legitimate client activity.

The primary remediation is to upgrade grpc-gateway to a version that includes the fix introduced in commit 72123cd. For applications that cannot immediately upgrade, apply the WithDisableHTTPMethodOverride() option when constructing the ServeMux:

mux := runtime.NewServeMux(
    runtime.WithDisableHTTPMethodOverride(),
)

This disables method override header processing while preserving the path-length fallback for form-encoded POST-to-GET routing. As an additional defense-in-depth measure, configure upstream WAFs and reverse proxies to strip or reject the X-HTTP-Method-Override header from inbound requests before they reach the gateway. Microsoft has released updated AZL3 packages for all affected downstream products (Microsoft MSRC, GitHub Commit).

The fix commit explicitly credits security researcher Mariusz Maik for discovering and responsibly reporting the vulnerability, noting his "hard work and tireless bughunting" (GitHub Commit). The vulnerability received coverage in Linux security roundup publications and was picked up by SUSE, openSUSE, and Debian security announcement lists due to its presence in widely used cloud-native packages. Tenable published Nessus detection plugins (IDs 341562 and 344683) and Qualys added detection (IDs 765011 and 765012), indicating broad scanner adoption. No significant social media controversy or vendor disputes have been observed.