CVE-2026-101916

[CVE catalog]

A flaw was found in grpc-js. In configurations where client certificates are optional, the authentication context lookup fails to distinguish between authorized and unauthorized peer certificates. A remote attacker can exploit this vulnerability by presenting an untrusted certificate, allowing them to bypass authentication mechanisms and access protected services. grpc-js: grpc-js: Authentication bypass via improper peer certificate validation Red Hat rates this vulnerability as Important because an unauthenticated remote client could bypass access control mechanisms when exposed gRPC services evaluate optional peer certificates. The issue manifests when services permit client certificates optionally and downstream authorization logic or role-based access control relies on the resulting peer authentication context. In environments where client certificates are strictly mandated or completely disabled at the transport layer, the condition cannot be triggered. Although successful exploitation requires specific configuration prerequisites, it allows complete circumvention of identity verification across exposed network services. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

High · CVSS 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Published

Sep 28, 2026, 8:01:53 PM UTC

Updated

Sep 28, 2026, 9:17:13 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.21% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "@grpc/grpc-js",
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "1.14.0"
            },
            {
              "fixed": "1.14.5"
            }
          ]
        }
      ],
      "ecosystem": "npm",
      "fixed_version": "1.14.5",
      "provider_record_id": "GHSA-M9GG-HP2V-232J"
    }
  ]
}