AIKIDO-2026-593870

TL;DR

BaseServerInterceptingCall.getAuthContext() in @grpc/grpc-js returns the peer's TLS certificate data for any TLS connection without checking the socket's authorized flag. Servers that create credentials with requireClientCertificate set to false and then rely on getAuthContext for authentication, such as @grpc/grpc-js-xds RBAC policies, cannot tell an unauthorized or self-signed client certificate from an authorized one. This lets an unauthorized client be treated as though it presented a trusted certificate. The fix checks socket.authorized before returning peer certificate data from getAuthContext.