PT-2026-26207 · Google · Grpc-Go
Mariuszmaik
·
Published
2026-03-18
·
Updated
2026-05-08
·
CVE-2026-33186
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions: gRPC-Go versions prior to 1.79.3
Description: gRPC-Go is vulnerable to an authorization bypass due to improper input validation of the HTTP/2
:path pseudo-header. The server incorrectly routes requests with missing leading slashes in the :path header, allowing attackers to bypass authorization checks if relying on path-based authorization interceptors (like grpc/authz) with a 'deny' rule for canonical paths and a fallback 'allow' rule. An attacker can exploit this by sending raw HTTP/2 frames with malformed :path headers directly to the gRPC server. There have been reports of increased actor activities targeting gRPC-Go (CVE-2026-33186).Recommendations: Upgrade to gRPC-Go version 1.79.3 or later. As a temporary workaround, implement a validating interceptor to reject requests with malformed paths, enforce infrastructure-level normalization of the
:path header, or harden authorization policies to a 'default deny' posture.Exploit
Fix
Improper Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Grpc-Go