CVE-2026-101916

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101916", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-28T15:55:37.907Z", "datePublished": "2026-09-28T20:01:53.640Z", "dateUpdated": "2026-10-01T14:54:55.987Z"}, "containers": {"cna": {"title": "@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j"}, {"name": "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee", "tags": ["x_refsource_MISC"], "url": "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee"}, {"name": "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c", "tags": ["x_refsource_MISC"], "url": "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c"}, {"name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5"}], "affected": [{"vendor": "grpc", "product": "grpc-node", "versions": [{"version": "< 1.13.6", "status": "affected"}, {"version": ">= 1.14.0, < 1.14.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-28T20:01:53.640Z"}, "descriptions": [{"lang": "en", "value": "@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6."}], "source": {"advisory": "GHSA-m9gg-hp2v-232j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-01T14:54:36.359795Z", "id": "CVE-2026-101916", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T14:54:55.987Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-101916", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-01T14:54:36.359795Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T14:54:48.751Z"}}], "cna": {"title": "@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized", "source": {"advisory": "GHSA-m9gg-hp2v-232j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "grpc", "product": "grpc-node", "versions": [{"status": "affected", "version": "< 1.13.6"}, {"status": "affected", "version": ">= 1.14.0, < 1.14.5"}]}], "references": [{"url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j", "name": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee", "name": "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c", "name": "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5", "name": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-28T20:01:53.640Z"}}}, "cveMetadata": {"cveId": "CVE-2026-101916", "state": "PUBLISHED", "dateUpdated": "2026-10-01T14:54:55.987Z", "dateReserved": "2026-09-28T15:55:37.907Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-28T20:01:53.640Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "grpc-node", "vendor": "grpc", "versions": [{"status": "affected", "version": "< 1.13.6"}, {"status": "affected", "version": ">= 1.14.0, < 1.14.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6."}], "id": "CVE-2026-101916", "lastModified": "2026-10-01T15:17:25.083", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101916", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-01T14:54:36.359795Z", "version": "2.0.3"}}]}, "published": "2026-09-28T21:17:13.030", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee"}, {"source": "security-advisories@github.com", "url": "https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c"}, {"source": "security-advisories@github.com", "url": "https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "grpc-js: grpc-js: Authentication bypass via improper peer certificate validation", "id": "2542678", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542678"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-295", "details": ["A flaw was found in grpc-js. In configurations where client certificates are optional, the authentication context lookup fails to distinguish between authorized and unauthorized peer certificates. A remote attacker can exploit this vulnerability by presenting an untrusted certificate, allowing them to bypass authentication mechanisms and access protected services."], "name": "CVE-2026-101916", "package_state": [{"cpe": "cpe:/a:redhat:podman_desktop:1", "fix_state": "Affected", "package_name": "rh-podman-desktop", "product_name": "Red Hat Build of Podman Desktop"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-gaudi-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/bootc-rocm-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Affected", "package_name": "rhelai3/disk-image-cuda-rhel9", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-09-28T20:01:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-101916\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101916\nhttps://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee\nhttps://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c\nhttps://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5\nhttps://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j"], "statement": "Red Hat rates this vulnerability as Important because an unauthenticated remote client could bypass access control mechanisms when exposed gRPC services evaluate optional peer certificates. The issue manifests when services permit client certificates optionally and downstream authorization logic or role-based access control relies on the resulting peer authentication context. In environments where client certificates are strictly mandated or completely disabled at the transport layer, the condition cannot be triggered. Although successful exploitation requires specific configuration prerequisites, it allows complete circumvention of identity verification across exposed network services.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.13.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.14.0,1.14.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "grpc-node", "source": "cna", "vendor": "grpc"}, "product": "grpc-node", "vendor": "grpc"}], "created": "2026-09-28T21:30:07.216952+00:00", "updated": "2026-09-28T21:45:06.606034+00:00", "vendors": ["grpc", "grpc$PRODUCT$grpc-node"]}