{"vulnerability": "CVE-2026-101914", "sightings": [{"uuid": "e310b4e4-8bbd-44a0-bccb-08b569ec5e38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-101914", "type": "seen", "source": "https://gist.github.com/alon710/8f28320497c3189bf7bde732901bd401", "content": "# CVE-2026-101914: CVE-2026-101914: Authorization Bypass via Case-Insensitive Path Matching in @grpc/grpc-js-xds\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-101914\n\n## Summary\nAn authorization bypass vulnerability exists in the @grpc/grpc-js Node.js package (specifically within the xDS plugin wrapper @grpc/grpc-js-xds) due to a logical error in its Role-Based Access Control (RBAC) path matching component. When case-insensitive path matching is enabled, the matching logic performs a prefix comparison using the startsWith method instead of a strict equality comparison. This logic flaw allows unauthenticated or low-privilege clients with access to a shorter path to gain unauthorized access to longer, more privileged method names that share the same prefix.\n\n## TL;DR\nA logical error in the @grpc/grpc-js xDS path matcher applies a prefix match instead of an exact match when case-insensitive comparison is enabled. This allows clients to bypass RBAC policies and access restricted service endpoints that share a prefix with authorized endpoints.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-187\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.5\n- **Confidentiality Impact**: Low\n- **Integrity Impact**: High\n- **Exploit Status**: PoC available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications running pure JavaScript gRPC deployments\n- Systems utilizing xDS-based RBAC policies with case-insensitive matching enabled in @grpc/grpc-js-xds\n- **@grpc/grpc-js**: < 1.13.1 (Fixed in: `1.13.1`)\n- **@grpc/grpc-js**: >= 1.14.0, < 1.14.1 (Fixed in: `1.14.1`)\n\n## Mitigation\n\n- Upgrade @grpc/grpc-js and @grpc/grpc-js-xds to version 1.13.1 or 1.14.1.\n- Disable case-insensitive exact path matching in xDS RBAC policy configurations.\n- Redesign gRPC method naming structures to avoid cases where an authorized method acts as a literal prefix of a restricted method.\n\n**Remediation Steps:**\n1. Open the application package.json and locate dependencies for @grpc/grpc-js.\n2. Update the version definition to '^1.13.1' or '^1.14.1' depending on your current release branch.\n3. Execute 'npm update @grpc/grpc-js' or 'yarn upgrade @grpc/grpc-js' to apply the updates.\n4. Audit existing xDS-based RBAC configurations and ensure that 'case_insensitive' options are set to false wherever possible as a defense-in-depth measure.\n5. Redeploy the updated application to production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-88h9-xgvx-hvf2](https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2)\n- [CVE-2026-101914 Mitre Record](https://www.cve.org/CVERecord?id=CVE-2026-101914)\n- [Release tag for version 1.13.1](https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1)\n- [Release tag for version 1.14.1](https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-101914) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-28T20:30:32.000000Z"}]}