grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22032-1 advisory.

    - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error     Handling       (bsc#1269861).
    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276742).
    - CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can     lead to       exfiltration of sensitive data (bsc#1267482).
    - CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause     a DoS       (bsc#1267483).
    - CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and     can cause OBI       out-of-bounds reads to leak memory into telemetry (bsc#1267484).
    - CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel     memory and cause       that memory to be copied into telemetry (bsc#1267486).
    - CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-     segment calls to       read and overwrite memory beyond the first segment (bsc#1267487).
    - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the     size of a       parameter value overflows the message buffer (bsc#1272418).
    - CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the     ebpf-profiler       agent (bsc#1268982).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272028).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278671).
    - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution     (bsc#1276982).
    - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the     reference storage       (bsc#1276992).
    - CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing     users who can       modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through     `bearerTokenFile`       (bsc#1277429).
    - CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated     database name in       Client.BulkWrite (bsc#1278693).
    - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response     frames       containing a crafted header value type byte outside the valid range can cause the host process to     terminate       (bsc#1280671).

    Changes for alloy:

    Update to version 1.19.2:

     * Remove withdrawn lib/pq CVEs from govulncheck
     * Add backticks to component name in generated doc output
     * BREAKING CHANGE: prometheus.operator.servicemonitors now      rejects endpoints that reference local files by default. Set      allow_arbitrary_file_access = true to preserve previous      behavior.
     * prometheus.enrich: Support multi-label matching
     * prometheus.relabel: Add opt-in TTL cache mode
     * telemetry: Add new metrics for graph connections and      pyroscope forwarded entries
     * database_observability: Exclude system schemas from MySQL      health checks and redact query text in explain_plans
     * Add nop receiver to OTel Engine
     * Backport dependency upgrades to address GO-2026-6061

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4408-1 advisory.

    - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error     Handling       (bsc#1269861).
    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277996).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276742).
    - CVE-2026-45679: go.opentelemetry.io/obi: Redis error text is exported in span status messages and can     lead to       exfiltration of sensitive data (bsc#1267482).
    - CVE-2026-45680: go.opentelemetry.io/obi: unbounded BPF internal metrics replay can exhaust CPU and cause     a DoS       (bsc#1267483).
    - CVE-2026-45681: go.opentelemetry.io/obi: CPU-mismatch fallback uses 256-byte buffer with 8KB size and     can cause OBI       out-of-bounds reads to leak memory into telemetry (bsc#1267484).
    - CVE-2026-45683: go.opentelemetry.io/obi: Java TLS ioctl kprobe allows a user to point OBI at kernel     memory and cause       that memory to be copied into telemetry (bsc#1267486).
    - CVE-2026-45684: go.opentelemetry.io/obi: log enricher mishandled `writev` buffers and allows multi-     segment calls to       read and overwrite memory beyond the first segment (bsc#1267487).
    - CVE-2026-46600: golang.org/x/net/dns/dnsmessage: Parsing an invalid SVCB or HTTPS RR can panic when the     size of a       parameter value overflows the message buffer (bsc#1272418).
    - CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the     ebpf-profiler       agent (bsc#1268982).
    - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input     (bsc#1272028).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278671).
    - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution     (bsc#1276982).
    - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the     reference storage       (bsc#1276992).
    - CVE-2026-75889: arbitrary file reads due to the `prometheus.operator.servicemonitors` component allowing     users who can       modify `ServiceMonitor` resources in a watched namespace to specify an arbitrary local file through     `bearerTokenFile`       (bsc#1277429).
    - CVE-2026-81521: go.mongodb.org/mongo-driver: MongoDB Go Driver: Write redirection via unvalidated     database name in       Client.BulkWrite (bsc#1278693).
    - CVE-2026-89090: github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: malformed EventStream response     frames       containing a crafted header value type byte outside the valid range can cause the host process to     terminate       (bsc#1280671).

    Changes for alloy:

    - Update to version 1.19.2.
    - Update to version 1.19.1.
    - Update to version 1.19.0:
     * BREAKING CHANGE: prometheus.operator.servicemonitors now      rejects endpoints that reference local files by default. Set      allow_arbitrary_file_access = true to preserve previous      behavior.
     * prometheus.enrich: Support multi-label matching
     * prometheus.relabel: Add opt-in TTL cache mode
     * telemetry: Add new metrics for graph connections and      pyroscope forwarded entries
     * database_observability: Exclude system schemas from MySQL      health checks and redact query text in explain_plans
    - Update to version 1.18.1:
     * Add nop receiver to OTel Engine

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23864-1 advisory.

    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277966).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276677).
    - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279316).
    - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279219).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in     gRPC-Go xDS       servers (bsc#1278997).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276677).
    - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279316).
    - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279219).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in     gRPC-Go xDS       servers (bsc#1278997).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21898-1 advisory.

    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277966).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276677).
    - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279316).
    - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279219).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in     gRPC-Go xDS       servers (bsc#1278997).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276677).
    - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279316).
    - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279219).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in     gRPC-Go xDS       servers (bsc#1278997).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4045-1 advisory.

    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277995).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276739).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4175-1 advisory.

    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276644).
    - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1278270).
    - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1278273).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in     gRPC-Go xDS       servers (bsc#1278688).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21801-1 advisory.

    - CVE-2026-24122: github.com/sigstore/cosign/v2/pkg/cosign: improper validation of certificates that     outlive expired CA       certificates (bsc#1258543).
    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1278002).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation: no rejection of     raw-length       headers in baggage parsing allows for DoS via oversized inputs (bsc#1276745).
    - CVE-2026-50163: oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks     (bsc#1278702).
    - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and     deadlocks in the       crypto/ssh library (bsc#1278624).
    - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1279390).
    - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1279395).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in     gRPC-Go xDS       servers (bsc#1279392).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21809-1 advisory.

    Update to version 3.21.1:

    - CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method     of a POST       request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277949).
    - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing     allows for DoS       via oversized inputs (bsc#1276644).
    - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: Malicious registry can hijack Bearer token     realm to       exfiltrate credentials and refresh tokens (bsc#1270127).
    - CVE-2026-50151: oras-go: Credential forwarding via unvalidated Location header during blob upload     (bsc#1271660).
    - CVE-2026-63308: processing zero-length byte slices in template chart files can trigger an index out-of-     range panic       (bsc#1272402).
    - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of     authorization       policies via mixed-case or canonical-case header matches (bsc#1278270).
    - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation     (bsc#1278273).
    - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing `:authority` and `Host` headers in     gRPC-Go xDS       servers (bsc#1278688).
    - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server     implementation       (bsc#1276514).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21793-1 advisory.

    Changes in hauler:

    - update to 2.1.0 (bsc#1265425, CVE-2026-41888):
      * `v2.1.0` is a **minor** release built on the containerd-         native foundation laid down in `v2.0.0`. The headline is that         `hauler store sync` and `hauler store add` are now fully         concurrent, with signature verification pinned to digests and         running in parallel too. Alongside that, this release adds an         audit trail, a store integrity checker, store-to-manifest         generation, private/insecure registry support across every         pull path, and a set of fixes for containerd imports, chunked         hauls, and Docker Hub reference handling.
      * **Notable dependency bumps:** Go  **1.26.6**;
        `containerd/v2`  2.3.4; `sigstore/cosign/v3`  3.1.3;
        `sigstore/sigstore`  1.10.9; `go-containerregistry`         0.22.0; `helm/v4`  4.2.4; `k8s.io` libs (apimachinery, api,         client-go)  0.37.0; `logrus`  1.10.2; `docker/go-metrics`         0.1.0; `sigstore/rekor`  1.5.4 (CVE resolution); plus         `x/mod` and `go-isatty`.

    - update to 2.0.3 (bsc#1276124,       CVE-2026-72817,CVE-2026-72815,CVE-2026-72816):
      * Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (backport         #688)
      * Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in the         go_modules group across 1 directory (backport #691)
      * fix for homebrew macOS binary quarantine (backport #690)
      * fix: process Helm deps before --add-images discovery         (backport #703)
      * update hauler store remove to handle registry reference as         part of string (backport #705)
      * fixed vuln for golang grpc

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-     Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with     Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an     arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls     enforced by upstream proxies or WAFs. (CVE-2026-37236)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364343	openSUSE 16 Security Update : alloy (openSUSE-SU-2026:22032-1)	Nessus	SuSE Local Security Checks	Local	high
362571	SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:4408-1)	Nessus	SuSE Local Security Checks	Local	high
350829	SUSE SLES16 Security Update : distribution (SUSE-SU-2026:23864-1)	Nessus	SuSE Local Security Checks	Local	high
350153	openSUSE 16 Security Update : distribution (openSUSE-SU-2026:21898-1)	Nessus	SuSE Local Security Checks	Local	high
348458	SUSE SLES15 Security Update : amazon-cloudwatch-agent (SUSE-SU-2026:4045-1)	Nessus	SuSE Local Security Checks	Local	critical
346217	SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2026:4175-1)	Nessus	SuSE Local Security Checks	Local	high
344683	openSUSE 16 Security Update : trivy (openSUSE-SU-2026:21801-1)	Nessus	SuSE Local Security Checks	Local	high
344664	openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21809-1)	Nessus	SuSE Local Security Checks	Local	high
343950	openSUSE 16 Security Update : hauler (openSUSE-SU-2026:21793-1)	Nessus	SuSE Local Security Checks	Local	medium
341562	Linux Distros Unpatched Vulnerability : CVE-2026-37236	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-37236

critical

Tenable Plugins

high

high

high

high

critical

high

high

high

medium

critical