What is CVE-2026-48599?

CVE-2026-48599 is a high-severity security vulnerability in grpc (erlang), affecting versions >= 0.8.0, < 1.0.0. It is fixed in 1.0.0.

Which versions of grpc are affected by CVE-2026-48599?

grpc (erlang) versions >= 0.8.0, < 1.0.0 is affected.

Is there a fix for CVE-2026-48599?

Yes. CVE-2026-48599 is fixed in 1.0.0. Upgrade to this version or later.

Is CVE-2026-48599 exploitable, and should I be worried?

Whether CVE-2026-48599 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-48599 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

CVE-2026-48599 in grpc

Q: Which versions of grpc are affected by CVE-2026-48599?

grpc (erlang) versions >= 0.8.0, < 1.0.0 is affected.

Q: Is there a fix for CVE-2026-48599?

Yes. CVE-2026-48599 is fixed in 1.0.0. Upgrade to this version or later.

Q: Is CVE-2026-48599 exploitable, and should I be worried?

Whether CVE-2026-48599 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-48599 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-48599?

Upgrade grpc to 1.0.0 or later.

Summary

gRPC Erlang package's path bindings are overridable by query string and request body

In the HTTP-to-gRPC transcoding layer of the grpc Hex package, query-string and request-body parameters can silently overwrite path-bound fields when building the decoded protobuf request struct. An authenticated attacker who can reach a transcoded endpoint can substitute any path-bound identifier (e.g. user_id from /users/{user_id}/profile) with an arbitrary value, bypassing authorization, multi-tenancy, and ownership checks that rely on the path-derived field.

Details

All three clauses of GRPC.Server.Transcode.map_request/5 (grpc_server/lib/grpc/server/transcode.ex) use Map.merge/2 with path bindings as the first argument, giving them the lowest merge precedence. Path bindings are extracted by the router from the matched URL template and should be the authoritative resource identifiers, but query-string and body parameters overwrite them. The decoded protobuf struct handed to the handler carries the attacker's value instead of the router's.

PoC

Deploy a transcoded gRPC service with a route like GET /users/{user_id}/profile where the handler authorizes access based on request.user_id.
Send: GET /users/me/profile?user_id=victim
The decoded request struct has user_id = "victim", the authorization check passes for the victim's resource, not the caller's.
Alternatively, for a POST with body: "*": send {"user_id": "victim"} in the JSON body.

References

Introduction commit: https://github.com/elixir-grpc/grpc/commit/8aaf3d3a8c4c7b08ac65e9c6f254e0d24da1d048
Patch commit: https://github.com/elixir-grpc/grpc/commit/33b6a095dbc91c6dee3c7b90893d7d74952e82e4

Impact

Affects applications using grpc ≥ 0.8.0 with HTTP transcoding enabled that rely on path-bound fields for authorization or tenant isolation. Fixed in 1.0.0. An authenticated attacker can read or modify any other user's resources exposed via transcoded endpoints.

Affected versions

grpc (>= 0.8.0, < 1.0.0)

Security releases

grpc → 1.0.0 (erlang)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Upgrade grpc to 1.0.0 or later to resolve this vulnerability.

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

What is CVE-2026-48599? CVE-2026-48599 is a high-severity security vulnerability in grpc (erlang), affecting versions >= 0.8.0, < 1.0.0. It is fixed in 1.0.0.
Which versions of grpc are affected by CVE-2026-48599? grpc (erlang) versions >= 0.8.0, < 1.0.0 is affected.
Is there a fix for CVE-2026-48599? Yes. CVE-2026-48599 is fixed in 1.0.0. Upgrade to this version or later.
Is CVE-2026-48599 exploitable, and should I be worried? Whether CVE-2026-48599 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-48599 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-48599? Upgrade grpc to 1.0.0 or later.