CVE-2026-48599: Authorization Bypass in elixir-grpc/grpc Transcoding Layer
Vulnerability ID: CVE-2026-48599
CVSS Score: 7.6
Published: 2026-08-25
An authorization bypass vulnerability exists in the elixir-grpc/grpc library version 0.8.0 up to 1.0.0. Due to insecure map merging precedence inside the HTTP-to-gRPC transcoding engine, query-string parameters and request bodies can override routing path variables, allowing attackers to execute unauthorized actions on other accounts.
TL;DR
An insecure Map.merge sequence in the elixir-grpc transcoding layer allows attackers to bypass tenancy controls by overriding authoritative path parameters via HTTP parameter pollution.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-639
- Attack Vector: Network (AV:N)
- CVSS v4.0 Score: 7.6 (High)
- EPSS Score / Percentile: 0.00273 / 19.15%
- Exploit Status: Proof-of-Concept
- CISA KEV Status: Not Listed
- Ransomware Use: No
Affected Systems
- elixir-grpc/grpc
-
elixir-grpc/grpc: >= 0.8.0, < 1.0.0 (Fixed in:
1.0.0)
Code Analysis
Commit: 33b6a09
Fix http transcode binding priorities
Mitigation Strategies
- Upgrade to elixir-grpc/grpc version 1.0.0 or higher
- Implement validation logic inside the gRPC service handler using authentication headers
- Configure API Gateways to strip conflicting query parameters
Remediation Steps:
- Modify your mix.exs file to pin grpc to version 1.0.0 or later.
- Run mix deps.get and mix deps.compile to fetch the patched library.
- Deploy the updated application to production environments.
References
- GHSA-mwr4-5g34-j5cq: Authorization Bypass in elixir-grpc/grpc
- Fix http transcode binding priorities
- Erlang Ecosystem Foundation Advisory
Read the full report for CVE-2026-48599 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)