CVE-2026-48599: Authorization Bypass in elixir-grpc Package via Path Binding Override
Summary
CVE-2026-48599: Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding. Affects grpc across 2 version ranges.
>= 0.8.0, < 1.0.0
>= 8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048, < 33b6a095dbc91c6dee3c7b90893d7d74952e82e4
Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The elixir-grpc package provides a framework for building gRPC services in Elixir, allowing developers to create efficient and scalable applications. It supports HTTP-to-gRPC transcoding, enabling seamless communication between HTTP clients and gRPC servers. However, this functionality introduces a vulnerability that can be exploited by authenticated attackers to bypass authorization checks.
Vulnerability Detail
The vulnerability arises from an authorization bypass through user-controlled key manipulation in the elixir-grpc grpc package. Specifically, in the 'Elixir.GRPC.Server.Transcode:map_request/5' function, path-bound fields can be overridden by attackers via the query string or request body. For instance, an attacker can send a request like GET /users/me/profile?user_id=victim, which allows them to access or modify resources belonging to other users. This flaw occurs because the path-bound field is merged with attacker-supplied values, leading to unauthorized access. The vulnerability affects versions of grpc from 0.8.0 to below 1.0.0.
How To Fix
Latest published version: 1.0.5 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation checks in your application to ensure that path-bound fields are not overridden by user input. This may involve explicitly checking the values of these fields against the expected values before processing requests.
Conclusion
CVE-2026-48599 represents a significant security risk for applications using the elixir-grpc package, allowing attackers to bypass authorization checks. It is crucial to update to version 1.0.0 or later to mitigate this vulnerability. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for grpc →
FAQ
CVE-2026-48599 is a vulnerability in the elixir-grpc package that allows authenticated attackers to bypass authorization checks by manipulating path-bound fields.
The vulnerability affects elixir-grpc versions from 0.8.0 to below 1.0.0.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score of this vulnerability is 7.6, indicating a high severity level.
If you cannot update the package immediately, implement additional validation checks to prevent unauthorized access as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for grpc.
