Is CVE-2026-48599 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48599 being exploited in the wild.

How severe is CVE-2026-48599?

High severity, with a CVSS score of 7.6, published 15 June 2026.

Which products and versions are affected?

Elixir Community gRPC 0.8.0 through 0.9.x.

Is there a fix for CVE-2026-48599?

A patch was published on 2026-06-15: Fix available in gRPC version 1.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48599 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48599?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48599: elixir-grpc authorization bypass in HTTP transcoding

CVE-2026-48599 · Severity: high · CVSS 7.6 · Published 2026-06-15

gRPC is a remote procedure call framework used to build high-performance APIs. The HTTP transcoding feature allows gRPC services to be called via standard HTTP requests. A vulnerability in versions 0.8.0 through 0.9.x allows authenticated users to override security-critical resource identifiers (like user IDs) by adding them to query strings or request bodies, bypassing authorization checks and potentially exposing or modifying other users' data.

Quick answers

Is CVE-2026-48599 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48599 being exploited in the wild.
How severe is CVE-2026-48599?: High severity, with a CVSS score of 7.6, published 15 June 2026.
Which products and versions are affected?: Elixir Community gRPC 0.8.0 through 0.9.x.
Is there a fix for CVE-2026-48599?: A patch was published on 2026-06-15: Fix available in gRPC version 1.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48599 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48599?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in `GRPC.Server.Transcode.map_request/5` within the gRPC server's transcoding layer. The function uses `Map.merge/2` with path bindings as the first argument, giving them the lowest merge precedence. This allows query-string and JSON request-body parameters to overwrite authoritative path-bound fields extracted from the URL template. An authenticated attacker can craft requests with overridden identifiers (e.g., `GET /users/me/profile?user_id=victim` or `POST` with `{"user_id": "victim"}`) to bypass access controls that rely on the path-derived values. The decoded protobuf struct passed to the handler contains the attacker's value instead of the router's, leading to unauthorized read and modify operations on other users' resources. The fix was applied in version 1.0.0 to ensure path bindings take precedence over user-supplied parameters.

Affected products

Elixir Community gRPC 0.8.0 through 0.9.x

Identifiers

CVE-2026-48599
GHSA-mwr4-5g34-j5cq

Timeline

2026-06-15: disclosed: CVE-2026-48599 published to NVD
2026-08-25: advisory: GitHub advisory GHSA-mwr4-5g34-j5cq published
2026-06-15: patched: Fix available in gRPC version 1.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.