Cpe:2.3:a:grpc:grpc-Js:*:*:*:*:*:node.js:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3agrpcgrpc-jsnode.js/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 30 Sep 2026 16:27:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgImproper Authentication in @grpc/grpc-jshttps://feed.craftedsignal.io/briefs/2026-09-grpc-js-auth-bypass/Wed, 30 Sep 2026 16:27:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-grpc-js-auth-bypass/The @grpc/grpc-js library contains an authentication bypass vulnerability (CVE-2026-101916) where unauthorized client certificates may be treated as authorized when requireClientCertificate is disabled.The @grpc/grpc-js library (CVE-2026-101916) exhibits a flaw in how it handles client certificate verification within the getAuthContext method. When developers configure server credentials with the requireClientCertificate option set to false, the library fails to properly distinguish between authorized and unauthorized client certificates in the returned authentication context. This vulnerability is particularly critical for applications that rely on the output of getAuthContext for Role-Based Access Control (RBAC) decisions. The issue is documented to affect the @grpc/grpc-js-xds integration, where specific configurations of DownstreamTlsContext can inadvertently enable this bypass, potentially allowing unauthenticated or unauthorized clients to gain access to protected resources. Defenders should prioritize updating affected packages to versions 1.13.6 or 1.14.5 to remediate this logic flaw.

Impact

The vulnerability allows for potential authentication bypass in gRPC-based services. If an application utilizes getAuthContext to enforce security policies, unauthorized parties may masquerade as authorized users. The scope of impact includes any infrastructure utilizing @grpc/grpc-js or @grpc/grpc-js-xds for internal or external service-to-service authentication. If exploited, an attacker could gain unauthorized access to backend services protected by RBAC, potentially leading to data exfiltration or unauthorized execution of RPC methods.

Recommendation

  • Update @grpc/grpc-js and @grpc/grpc-js-xds dependencies to version 1.13.6 or 1.14.5 immediately to patch CVE-2026-101916.
  • Audit application code for usage of getAuthContext to ensure it is not relied upon for security-critical RBAC decisions without explicit client certificate verification.
  • For configurations that cannot be patched immediately, set the requireClientCertificate option to true in the gRPC server credentials.
  • For @grpc/grpc-js-xds users, set the require_client_certificate field to true within the DownstreamTlsContext in the xDS configuration to enforce certificate validation.
]]>highadvisoryvulnerabilitygrpcrbacauthentication-bypass