CVE-2026-101914: Authorization Bypass via Case-Insensitive Path Matching in @grpc/grpc-js-xds

The @grpc/grpc-js library is a pure JavaScript implementation of the gRPC protocol for Node.js. In microservices architectures, authorization is frequently managed via xDS-based Role-Based Access Control (RBAC) policies, which are parsed and enforced by the @grpc/grpc-js-xds plugin. This component is responsible for examining incoming remote procedure calls (RPCs) and ensuring that clients possess the correct permissions to execute requested methods.

Within this architecture, exact path matching represents a critical mechanism for limiting access to specific gRPC endpoints. Paths are defined hierarchically in the format /ServiceName/MethodName. The vulnerability lies in the logical verification of these paths when processing rules that specify case-insensitive matching.

The attack surface is exposed to any network client capable of sending gRPC requests to an endpoint that relies on the @grpc/grpc-js-xds component for RBAC. Exploitation does not require authentication to the target service if the underlying RBAC rule relies on case-insensitive exact matching to grant permissions.

The root cause of this vulnerability is a logical flaw classified as CWE-187 (Partial String Comparison) and CWE-863 (Incorrect Authorization). In @grpc/grpc-js-xds, the exact path matching logic is implemented within the PathExactValueMatcher class inside packages/grpc-js-xds/src/matcher.ts. This class handles evaluations of incoming RPC paths against configured authorization policies.

When a policy demands an exact match, the evaluator is designed to perform a strict string comparison. However, the implementation branches based on whether the matching rule is case-sensitive. If caseInsensitive is false, the engine correctly performs a strict equality comparison using the identity operator.

When caseInsensitive is true, the engine attempts to normalize the strings using the JavaScript toLowerCase() method. Instead of applying a strict equality check to the normalized strings, the code invokes the startsWith() method. This implementation error changes the behavior from an exact match to a prefix match, validating any incoming path that begins with the target value defined in the policy.

An analysis of the vulnerable codebase in packages/grpc-js-xds/src/matcher.ts reveals the precise code path responsible for the comparison error. The implementation of the apply method in PathExactValueMatcher was written as follows before the patch:

export class PathExactValueMatcher {
  // ...
  apply(value: string) {
    if (this.caseInsensitive) {
      // VULNERABLE: Performs a prefix check instead of a strict equality check
      return value.toLowerCase().startsWith(this.targetValue.toLowerCase());
    } else {
      // CORRECT: Performs a strict equality check
      return value === this.targetValue;
    }
  }
}

Because of the startsWith() call, an incoming string value such as /myService.Service/MethodSecret matches a policy path of /myService.Service/Method because the prefix matches perfectly. The security patch resolves this discrepancy by replacing the prefix evaluation with a strict equality comparison of the lowercased strings:

export class PathExactValueMatcher {
  // ...
  apply(value: string) {
    if (this.caseInsensitive) {
      // FIXED: Performs case-insensitive strict equality check
      return value.toLowerCase() === this.targetValue.toLowerCase();
    } else {
      return value === this.targetValue;
    }
  }
}

The fix is complete and robust against basic prefix-matching bypass vectors. However, developers should be aware that JavaScript toLowerCase() does not account for complex Unicode case folding. While standard gRPC paths are limited to ASCII, any implementations utilizing non-ASCII characters in route configurations could theoretically experience normalization discrepancies.

Exploitation of CVE-2026-101914 requires specific configuration prerequisites on the target gRPC server. The target server must employ xDS-based RBAC policies, contain at least one rule using case_insensitive: true for an exact path matcher, and host service endpoints where one method name serves as a prefix to another more restrictive method.

Consider a deployment where a low-privilege client is authorized to access the /Service/Check method. The server also hosts a highly privileged administrative method named /Service/CheckAdmin. The RBAC policy uses case-insensitive exact matching to authorize access to /Service/Check.

An attacker sends a gRPC request targeting /Service/CheckAdmin. The RBAC engine intercepting the request evaluates the path against the policy. Because of the bug, the evaluation /service/checkadmin.startsWith(/service/check) returns true. The server then executes /Service/CheckAdmin, granting the attacker unauthorized access to administrative functionality.

The overall security impact of this vulnerability is calculated at a CVSS 3.1 Base Score of 6.5 (Medium). The attack vector is Network, and complexity is rated as High due to the specific naming and policy configurations required to trigger the exploit.

When successfully exploited, the integrity of the application is severely compromised because attackers can perform actions they are not authorized to execute. The confidentiality impact is rated as Low because the primary outcome is unauthorized function execution, though this execution may leak state or data. The availability impact is rated as None because the logical flaw does not directly cause application crashes or resource depletion.

This vulnerability is particularly significant in microservices environments that utilize a single gRPC server interface to handle both public and internal endpoints. Bypassing service mesh security boundaries at the gRPC transport layer allows attackers to bypass lateral movement protections and access backend administrative controls.

To fully remediate CVE-2026-101914, administrators and developers must update their @grpc/grpc-js and @grpc/grpc-js-xds dependencies to patched versions. The official fixes are backported and released in multiple release streams.

For systems running on the 1.13.x release line, the package must be upgraded to version 1.13.1 or higher. For systems running on the 1.14.x release line, the package must be upgraded to version 1.14.1 or higher.

If upgrading dependencies is not immediately viable, the vulnerability can be mitigated by disabling case-insensitive matching in the xDS control plane configurations. Setting case_insensitive to false in RBAC policies ensures the engine executes the strict equality code branch. Additionally, services can be refactored to eliminate naming overlaps where one method name is a prefix of another.