https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 06:54:43 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-128065 <p>@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is not registered under the override message type, override maps are stored under a type URL instead of the configured HTTP filter name, and VirtualHost override maps are not read. When experimental RBAC is enabled and a trusted xDS control plane supplies a broad top-level ALLOW policy with a stricter matching override, affected servers evaluate RPCs under the broad policy and can accept requests that should be denied. This issue is fixed in version 1.14.2.</p> <p>@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is not registered under the override message type, override maps are stored under a type URL instead of the configured HTTP filter name, and VirtualHost override maps are not read. When experimental RBAC is enabled and a trusted xDS control plane supplies a broad top-level ALLOW policy with a stricter matching override, affected servers evaluate RPCs under the broad policy and can accept requests that should be denied. This issue is fixed in version 1.14.2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-128065 https://db.gcve.eu/vuln/ghsa-gg5j-6742-v827 <p><strong>Affected:</strong> npm: @grpc/grpc-js-xds</p> <p>### Summary</p> <p>`XdsServer` in `@grpc/grpc-js-xds` does not apply `RBACPerRoute` overrides from matching Route or VirtualHost resources. When a trusted xDS control plane supplies a broad top-level ALLOW policy and a stricter override, `XdsServer` ACKs the resources but evaluates the RPC under the top-level policy.</p> <p>### Details</p> <p>### Override parser lookup uses the override message type</p> <p>`parseOverrideFilterConfig()` in packages/grpc-js-xds/src/http-filter.ts:225-257 looks up FILTER_REGISTRY using the override message type:</p> <p>`type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute` Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter.ts#L225-L257</p> <p>`setup()` in packages/grpc-js-xds/src/http-filter/rbac-filter.ts:167-173 registers the filter only under the top-level RBAC type:</p> <p>`type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC` Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter/rbac-filter.ts#L167-L173</p> <p>The lookup returns null even though the registered entry contains `parseOverrideRbacConfig()`, and server.ts silently skips the override.</p> <p>### Override maps are keyed by type URL instead of filter name</p> <p>`overrideConfigMaps` in server.ts:99-102 is documented as keyed by HTTP filter name, but server.ts:169-174 stores each map under `filterConfig.typeUrl`.</p> <p>Source: https://github.com/grpc/grpc-node/blob/56567d9604…</p> <p><strong>Affected:</strong> npm: @grpc/grpc-js-xds</p> <p>### Summary</p> <p>`XdsServer` in `@grpc/grpc-js-xds` does not apply `RBACPerRoute` overrides from matching Route or VirtualHost resources. When a trusted xDS control plane supplies a broad top-level ALLOW policy and a stricter override, `XdsServer` ACKs the resources but evaluates the RPC under the top-level policy.</p> <p>### Details</p> <p>### Override parser lookup uses the override message type</p> <p>`parseOverrideFilterConfig()` in packages/grpc-js-xds/src/http-filter.ts:225-257 looks up FILTER_REGISTRY using the override message type:</p> <p>`type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute` Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter.ts#L225-L257</p> <p>`setup()` in packages/grpc-js-xds/src/http-filter/rbac-filter.ts:167-173 registers the filter only under the top-level RBAC type:</p> <p>`type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC` Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter/rbac-filter.ts#L167-L173</p> <p>The lookup returns null even though the registered entry contains `parseOverrideRbacConfig()`, and server.ts silently skips the override.</p> <p>### Override maps are keyed by type URL instead of filter name</p> <p>`overrideConfigMaps` in server.ts:99-102 is documented as keyed by HTTP filter name, but server.ts:169-174 stores each map under `filterConfig.typeUrl`.</p> <p>Source: https://github.com/grpc/grpc-node/blob/56567d9604…</p> https://db.gcve.eu/vuln/ghsa-gg5j-6742-v827