Log in Start free

Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M

CVE-2026-33186gRPC-Go has an authorization bypass via missing leading slash in :path

Critical 9.1

In plain English

A critical-severity security flaw in grpc-go from grpc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)1.6%top 23.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10opentelemetry-collector0.144.0-2.el10_2ALSA-2026:19135
AlmaLinux:9opentelemetry-collector0.144.0-2.el9_8ALSA-2026:19353
AlmaLinux:8osbuild-composer101.5-1.el8_10.alma.1ALSA-2026:48790
AlmaLinux:8osbuild-composer-core101.5-1.el8_10.alma.1ALSA-2026:48790
AlmaLinux:8osbuild-composer-worker101.5-1.el8_10.alma.1ALSA-2026:48790
Alpine:v3.24rclone1.73.5-r0ALPINE-CVE-2026-33186
Debian:12golang-google-grpcno fix listedDEBIAN-CVE-2026-33186
Debian:13golang-google-grpcno fix listedDEBIAN-CVE-2026-33186
Debian:14golang-google-grpc1.79.3-1DEBIAN-CVE-2026-33186
Gogoogle.golang.org/grpc1.79.3GHSA-p77j-4mvh-x3m3
Gogoogle.golang.org/grpc1.79.3GO-2026-4762
Rocky Linux:10image-builder0:52.1-1.el10_2.rocky.0.1RLSA-2026:22937
Rocky Linux:9image-builder0:52.1-1.el9_8RLSA-2026:23228
Rocky Linux:10opentelemetry-collector0:0.144.0-2.el10_2RLSA-2026:19135
Rocky Linux:9opentelemetry-collector0:0.144.0-2.el9_8RLSA-2026:19353
Rocky Linux:10osbuild-composer0:165.1-2.el10_2.rocky.0.1RLSA-2026:22450
Rocky Linux:8osbuild-composer0:101.5-1.el8_10.rocky.0.6RLSA-2026:48790
Rocky Linux:9osbuild-composer0:165.1-2.el9_8.rocky.0.1RLSA-2026:22714
Ubuntu:22.04:LTSgolang-google-grpcno fix listedUBUNTU-CVE-2026-33186
Ubuntu:25.10golang-google-grpcno fix listedUBUNTU-CVE-2026-33186
Ubuntu:26.04:LTSgolang-google-grpcno fix listedUBUNTU-CVE-2026-33186
Ubuntu:26.10golang-google-grpcno fix listedUBUNTU-CVE-2026-33186
Ubuntu:22.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-33186
Ubuntu:24.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-33186
Ubuntu:25.10google-guest-agentno fix listedUBUNTU-CVE-2026-33186
Ubuntu:26.04:LTSgoogle-guest-agentno fix listedUBUNTU-CVE-2026-33186
Ubuntu:26.10google-guest-agentno fix listedUBUNTU-CVE-2026-33186

Affected products (as reported)

VendorProductVersions
grpc grpc-go < 1.79.3

Weakness: CWE-285, CWE-551 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References