CVE-2026-101914: Auth Bypass (CVSS 6.5)

Description

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1.

Is your site exposed to CVE-2026-101914?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

EPSS — Exploit Prediction

0.0025

Probability of exploitation

0.15%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-187 CWE-187

CWE-863 Incorrect Authorization

References

Other References

https://github.com/grpc/grpc-node/commit/6cf64b596da03f1942a6b168998f0670217a99c4 https://github.com/grpc/grpc-node/commit/a6c5b31180cc8cea94d0a5ea215ce31a49e0409f https://github.com/grpc/grpc-node/commit/f32f3712e44581d8dfc8359bd8d30096662f4c75 https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.13.1 https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js-xds%401.14.1 https://github.com/grpc/grpc-node/security/advisories/GHSA-88h9-xgvx-hvf2

Frequently Asked Questions

What is CVE-2026-101914? +

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. If one service method name prefixes another and the methods have different access rules, a request for the longer method can match the shorter method's rule and cause incorrect authorization. This issue is fixed in versions 1.13.1 and 1.14.1. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2026-101914? +

CVE-2026-101914 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0025, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-101914? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-94576

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d …

CVE-2024-41110 9.9

Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions …

CVE-2024-39742 8.1

IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due …

CVE-2026-87853 7.5

A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with …

CVE-2026-44837 5.9

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, …

CVE-2026-81479 5.8

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local …

CVE-2026-101914