@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is not registered under the override message type, override maps are stored under a type URL instead of the configured HTTP filter name, and VirtualHost override maps are not read. When experimental RBAC is enabled and a trusted xDS control plane supplies a broad top-level ALLOW policy with a stricter matching override, affected servers evaluate RPCs under the broad policy and can accept requests that should be denied. This issue is fixed in version 1.14.2.

Source published

12 Nov 2026 22:45:27 UTC

Source modified

13 Nov 2026 00:39:00 UTC

Saved here

13 Nov 2026 02:16:18 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is not registered under the override message type, override maps are stored under a type URL instead of the configured HTTP filter name, and VirtualHost override maps are not read. When experimental RBAC is enabled and a trusted xDS control plane supplies a broad top-level ALLOW policy with a stricter matching override, affected servers evaluate RPCs under the broad policy and can accept requests that should be denied. This issue is fixed in version 1.14.2.

Source published

Nov 12, 2026, 10:45:27 PM (timezone not stated)

Source modified

Nov 13, 2026, 12:39:00 AM (timezone not stated)

Saved here

15 Nov 2026 00:31:23 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is not registered under the override message type, override maps are stored under a type URL instead of the configured HTTP filter name, and VirtualHost override maps are not read. When experimental RBAC is enabled and a trusted xDS control plane supplies a broad top-level ALLOW policy with a stricter matching override, affected servers evaluate RPCs under the broad policy and can accept requests that should be denied. This issue is fixed in version 1.14.2.

Source published

13 Nov 2026 00:20:14 UTC

Source modified

13 Nov 2026 02:18:56 UTC

Saved here

15 Nov 2026 00:30:56 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 4.0 · [email protected] · Secondary · 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

### Summary `XdsServer` in `@grpc/grpc-js-xds` does not apply `RBACPerRoute` overrides from matching Route or VirtualHost resources. When a trusted xDS control plane supplies a broad top-level ALLOW policy and a stricter override, `XdsServer` ACKs the resources but evaluates the RPC under the top-level policy. ### Details ### Override parser lookup uses the override message type `parseOverrideFilterConfig()` in packages/grpc-js-xds/src/http-filter.ts:225-257 looks up FILTER_REGISTRY using the override message type: `type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute` Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter.ts#L225-L257 `setup()` in packages/grpc-js-xds/src/http-filter/rbac-filter.ts:167-173 registers the filter only under the top-level RBAC type: `type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC` Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter/rbac-filter.ts#L167-L173 The lookup returns null even though the registered entry contains `parseOverrideRbacConfig()`, and server.ts silently skips the override. ### Override maps are keyed by type URL instead of filter name `overrideConfigMaps` in server.ts:99-102 is documented as keyed by HTTP filter name, but server.ts:169-174 stores each map under `filterConfig.typeUrl`. Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L99-L102 Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L169-L174 Route overrides are later looked up by their `typed_per_filter_config` key, which is the `HttpFilter.name`. An ordinary key such as rbac therefore misses the stored map. ### VirtualHost overrides are not read `handleRouteConfigurationResource()` in server.ts:225-249 reads `route.typed_per_filter_config` but never reads `virtualHost.typed_per_filter_config`. Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/server.ts#L225-L249 When no override reaches the RBAC interceptor, rbac-filter.ts:125-155 evaluates the broader top-level policy. ### Proof of concept Set: ``` GRPC_XDS_EXPERIMENTAL_RBAC=true ``` Run `XdsServer` with a protected unary handler. Have the ADS control plane deliver a Listener containing an RBAC HTTP filter named rbac with a top-level ALLOW-any policy: ``` name: rbac typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC rules: action: ALLOW policies: allow-any: principals: [{ any: true }] permissions: [{ any: true }] ``` Deliver a matching non-forwarding route with this override: ``` typed_per_filter_config: rbac: "@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute rbac: rules: action: DENY policies: deny-any: principals: [{ any: true }] permissions: [{ any: true }] ``` Invoke the protected unary method without credentials. Expected: The route-specific DENY policy rejects the RPC before the protected handler runs. Observed: `XdsServer` ACKs the resources, retains the top-level ALLOW policy, and runs the protected handler. ``` Listener and RouteConfiguration: ACKED gRPC status: OK handler invocations: 1 response: PROTECTED_SECRET_RECORD_RBAC_OVERRIDE ``` ### Impact Users of `@grpc/grpc-js-xds` who are using RBAC-based authentication with override configurations may unintentionally accept some requests that should be rejected.

Source published

12 Nov 2026 22:55:47 UTC

Source modified

12 Nov 2026 23:15:03 UTC

Saved here

13 Nov 2026 00:16:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Publisher rating · MODERATE