Answer in brief
CVE-2026-124278 records a High severity (CVSS 7.6) vulnerability in Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server. The current sources do not mark it as known exploited. The current feed maps elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/grpc (generic), elixir-grpc/grpc_server (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/elixir-grpc/grpc (generic), elixir-grpc/grpc (generic), elixir-grpc/grpc_server (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| elixir-grpc/elixir-grpc/grpcgeneric | >=0332faae5f5e132314794dbfdae5edecbccea292 <953ab980d8a127e895d3ab9505fc4b9337bb32f7 | 953ab980d8a127e895d3ab9505fc4b9337bb32f7 |
| elixir-grpc/elixir-grpc/grpcgeneric | >=8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048 <0332faae5f5e132314794dbfdae5edecbccea292 | 0332faae5f5e132314794dbfdae5edecbccea292 |
| elixir-grpc/grpcgeneric | >=0.8.0 <1.0.0 | 1.0.0 |
| elixir-grpc/grpc_servergeneric | >=1.0.0 <1.1.0 | 1.1.0 |
Published upstream
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 13, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 13, 2026
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type. Only the transcoding clause of GRPC.Server.do_handle_request/4 (grpc_server/lib/grpc/server.ex, and lib/grpc/server.ex before the package split) applies the route's path bindings to the request message. The Cowboy handler picks that clause from the request Content-Type, not from the route. A request to a transcoded URL with application/grpc or application/grpc-web is decoded from the body alone, so every path-bound field takes its value from the body. A gateway, proxy rule or WAF that authorizes on the URL path sees one resource while the handler receives another. This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.8.0 before 1.0.0.
Quoted source text, attributed separately from HOL analysis.