{"id":"CVE-2026-101916","aliases":["GHSA-m9gg-hp2v-232j"],"url":"https://o3.security/vulnerability/CVE-2026-101916","summary":"@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized","details":"### Impact\nWhen server credentials are created with the `requireClientCertificate` option set to `false`, `getAuthContext` does not distinguish between authorized and unauthorized certificates in its return value. This can create improper authentication vulnerabilities for `@grpc/grpc-js` users who use the result of `getAuthContext` for authentication.\n\nIn particular, `@grpc/grpc-js-xds` can both set the `requireClientCertificate` option to `false` and use the return value of `getAuthContext` for RBAC authentication in some configurations.\n\n### Patches\n\nThis vulenrability is fixed in 1.13.6 and 1.14.5.\n\n### Workarounds\n`@grpc/grpc-js` users using `getAuthContext` this way can avoid this problem by setting `requireClientCertificate` to `true`. `@grpc/grpc-js-xds` users using RBAC can avoid this by setting the `require_client_certificate` field to `true` in the DownstreamTlsContext in the xDS configuration.","published":"2026-09-28T20:01:53.640Z","modified":"2026-10-21T02:54:27.525896050Z","cvss":{"score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@grpc/grpc-js","fixedVersion":"1.13.6"},{"ecosystem":"npm","name":"@grpc/grpc-js","fixedVersion":"1.14.5"}],"fix":{"url":"https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee","label":"grpc/grpc-node@2a84ec8"},"references":[{"type":"WEB","url":"https://github.com/grpc/grpc-node/releases/tag/@grpc/grpc-js%401.14.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101916.json"},{"type":"ADVISORY","url":"https://github.com/grpc/grpc-node/security/advisories/GHSA-m9gg-hp2v-232j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101916"},{"type":"FIX","url":"https://github.com/grpc/grpc-node/commit/2a84ec8b01b9db68ed9d2b117a53a81449edb8ee"},{"type":"FIX","url":"https://github.com/grpc/grpc-node/commit/b4e0079c6d22a2adedfcac748e0bc083f783bc7c"},{"type":"PACKAGE","url":"https://github.com/grpc/grpc-node"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:54:27.525896050Z"}}