- Severity: MEDIUM
- CVE: CVE-2026-128065
- Ecosystems: npm
- Packages: @grpc/grpc-js-xds
### Summary
`XdsServer` in `@grpc/grpc-js-xds` does not apply `RBACPerRoute` overrides from matching Route or VirtualHost resources. When a trusted xDS control plane supplies a broad top-level ALLOW policy and a stricter override, `XdsServer` ACKs the resources but evaluates the RPC under the top-level policy.
### Details
### Override parser lookup uses the override message type
`parseOverrideFilterConfig()` in packages/grpc-js-xds/src/http-filter.ts:225-257 looks up FILTER_REGISTRY using the override message type:
`type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute`
Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter.ts#L225-L257
`setup()` in packages/grpc-js-xds/src/http-filter/rbac-filter.ts:167-173 registers the filter only under the top-level RBAC type:
`type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC`
Source: https://github.com/grpc/grpc-node/blob/56567d9604b4e45cdca0d2e3c2a60ac227ee659d/packages/grpc-js-xds/src/http-filter/rbac-filter.ts#L167-L173
The lookup returns null even though the registered entry contains `parseOverrideRbacConfig()`, and server.ts silently skips the override.
### Override maps are keyed by type URL instead of filter name
`overrideConfigMaps` in server.ts:99-102 is documented as keyed by HTTP filter name, but server.ts:169-174 stores each map under `filterConfig.typeUrl`.
Source: https://github.com/grpc/grpc-node/blob/56567d9604b…
Source: GitHub Security Advisories · 2026-11-12