# CVE-2026-128065: grpc-js-xds RBAC override policy bypass

Source: https://junglewise.ai/threats/cve-2026-128065-grpc-grpc-js-rbac-override-configs-in-virtualhost-and-route  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-13. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-128065 · Severity: medium · CVSS 4 · Published 2026-11-13

gRPC's xDS integration for Node.js fails to apply RBAC (Role-Based Access Control) override policies defined on individual routes or virtual hosts, causing the server to enforce only the top-level RBAC policy. This allows attackers to access protected RPC methods that should be denied by stricter per-route policies, potentially exposing sensitive data or functionality that was intended to be restricted.

Technologies: [@grpc/grpc-js-xds (npm)](https://junglewise.ai/threats/technologies/grpc-grpc-js-xds). Vendors: [Grpc](https://junglewise.ai/threats/vendors/grpc), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-128065 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-128065 being exploited in the wild.

**How severe is CVE-2026-128065?** Medium severity, with a CVSS score of 4, published 13 November 2026.

**Which products and versions are affected?** @grpc/grpc-js-xds (npm) >= 1.14.0, < 1.14.2, SEMVER:introduced=1.14.0,fixed=1.14.2.

**Is there a fix for CVE-2026-128065?** Yes. @grpc/grpc-js-xds (npm): upgrade to 1.14.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-128065 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-128065?** Check whether you run Grpc-Js-Xds or @grpc/grpc-js-xds (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @grpc/grpc-js-xds (npm): upgrade to 1.14.2 or later

  ```sh
  npm install @grpc/grpc-js-xds@1.14.2
  ```


## Technical details

The vulnerability stems from three distinct implementation flaws in the XdsServer: (1) the override filter lookup uses the override message type (RBACPerRoute) which is never registered in the filter registry—only the base RBAC type is registered; (2) override config maps are keyed by type URL rather than filter name, causing lookups by the filter's logical name to fail; and (3) VirtualHost-level typed_per_filter_config is never read at all. When overrides are not found, the server silently falls back to the top-level RBAC policy, bypassing intended route-level restrictions.

## Affected products

- grpc grpc-js-xds

## Identifiers

- CVE-2026-128065
- GHSA-gg5j-6742-v827

## Timeline

- 2026-11-12: disclosed

## Related threats

- [@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.](https://junglewise.ai/threats/cve-2026-126367-grpc-grpc-js-safe-regex-incorrectly-applies-partial-string)
- [gRPC grpc-js incorrect authorization in RBAC path matching](https://junglewise.ai/threats/cve-2026-101914-grpc-grpc-js-the-exact-path-match-matcher-incorrectly-only)