VDB

CVE-2026-101916

CVE-2026-101916 PUBLISHED CVSS 7.4 HIGH

Reported by GitHub_M · Published September 28, 2026

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.

Risk Scores

CVSS 3.1
7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products

VendorProductVersions
grpcgrpc-node< 1.13.6, >= 1.14.0, < 1.14.5
wolfilangfuse-30
chainguardkibana-8.190
chainguarddotstatsuite-supercore0
chainguardlangfuse-fips-30
chainguardcadence-web0
grpcgrpc-js1.14.0, 0
grpcgrpc-node1.14.0, 0
wolfipulumi0
chainguardazurite0
chainguardhomepage0
chainguardpulumi0
chainguardlibrechat0
chainguardzitadel-40
chainguardlangfuse-30
chainguardopentelemetry-auto-instrumentations-node0

Timeline

  • Sep 28, 2026 CVE Published
  • Sep 29, 2026 EPSS Score
  • Oct 1, 2026 CVE Updated
  • Oct 5, 2026 EPSS Score
  • Oct 8, 2026 EPSS Score
  • Oct 13, 2026 EPSS Score
  • Oct 19, 2026 EPSS Score
  • Oct 25, 2026 EPSS Score
  • Oct 29, 2026 EPSS Score
  • Oct 30, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›