Is CVE-2026-128065 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-128065 being exploited in the wild.

How severe is CVE-2026-128065?

Medium severity, with a CVSS score of 4, published 13 November 2026.

Which products and versions are affected?

@grpc/grpc-js-xds (npm) >= 1.14.0, < 1.14.2, SEMVER:introduced=1.14.0,fixed=1.14.2.

Is there a fix for CVE-2026-128065?

Yes. @grpc/grpc-js-xds (npm): upgrade to 1.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-128065 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-128065?

Check whether you run Grpc-Js-Xds or @grpc/grpc-js-xds (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-128065: grpc-js-xds RBAC override policy bypass

Q: Is there a fix for CVE-2026-128065?

Yes. @grpc/grpc-js-xds (npm): upgrade to 1.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-128065 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-128065?

Check whether you run Grpc-Js-Xds or @grpc/grpc-js-xds (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-128065 · Severity: medium · CVSS 4 · Published 2026-11-13

gRPC's xDS integration for Node.js fails to apply RBAC (Role-Based Access Control) override policies defined on individual routes or virtual hosts, causing the server to enforce only the top-level RBAC policy. This allows attackers to access protected RPC methods that should be denied by stricter per-route policies, potentially exposing sensitive data or functionality that was intended to be restricted.

Technologies: @grpc/grpc-js-xds (npm). Vendors: Grpc, npm.

Quick answers

Is CVE-2026-128065 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-128065 being exploited in the wild.
How severe is CVE-2026-128065?: Medium severity, with a CVSS score of 4, published 13 November 2026.
Which products and versions are affected?: @grpc/grpc-js-xds (npm) >= 1.14.0, < 1.14.2, SEMVER:introduced=1.14.0,fixed=1.14.2.
Is there a fix for CVE-2026-128065?: Yes. @grpc/grpc-js-xds (npm): upgrade to 1.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-128065 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-128065?: Check whether you run Grpc-Js-Xds or @grpc/grpc-js-xds (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@grpc/grpc-js-xds (npm): upgrade to 1.14.2 or later
```
npm install @grpc/grpc-js-xds@1.14.2
```

Technical details

The vulnerability stems from three distinct implementation flaws in the XdsServer: (1) the override filter lookup uses the override message type (RBACPerRoute) which is never registered in the filter registry—only the base RBAC type is registered; (2) override config maps are keyed by type URL rather than filter name, causing lookups by the filter's logical name to fail; and (3) VirtualHost-level typed_per_filter_config is never read at all. When overrides are not found, the server silently falls back to the top-level RBAC policy, bypassing intended route-level restrictions.

Affected products

grpc grpc-js-xds

Identifiers

CVE-2026-128065
GHSA-gg5j-6742-v827

Timeline

2026-11-12: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.