Vulnary
← back to the feed
Critical· 9.1official fix available

CVE-2026-33186

gRPC-Go servers before version 1.79.3 could let attackers bypass authorization by sending requests whose HTTP/2 ":path" header omitted the required leading slash. The server routed these requests but the authorization logic evaluated the non‑canonical path, causing deny rules to fail and allowing access if a default allow rule existed. The issue is fixed in gRPC-Go 1.79.3, which rejects such malformed paths.

publishedMar 20, 2026
last modifiedAug 4, 2026
sourcesNVD
severity · cvss
9.1
critical · how bad it is
exploitation · epss
2%
73th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 18, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Developers running gRPC-Go servers that use path‑based authorization interceptors—such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors that rely on info.FullMethod or grpc.Method(ctx)—and that have deny rules for canonical paths but a fallback allow rule. Typical users are Go developers deploying gRPC services.

02

Real-world impact

An attacker who can send raw HTTP/2 frames to the gRPC server can craft a request with a malformed ":path" header (e.g., "Service/Method" instead of "/Service/Method"). This bypasses the server’s deny rules, allowing the attacker to invoke protected RPC methods and potentially read or modify sensitive data.

03

Why this severity

The CVSS score of 9.1 reflects a network‑accessible vulnerability that requires no special privileges or user interaction. Because the flaw allows an attacker to compromise confidentiality and integrity of protected services, it is rated as critical.

04

What to do about it

official fix available
recommended steps
  1. 01Upgrade your gRPC-Go library to version 1.79.3 or later.
  2. 02Restart the gRPC server to load the updated library.
interim mitigations
  • ›Add a validating interceptor that rejects requests whose ":path" header does not start with a slash.
  • ›Normalize incoming paths at the infrastructure level before they reach the gRPC server.
  • ›Harden your authorization policy by removing any default allow rules and explicitly denying all paths not explicitly allowed.

NVD description

05

Timeline

  1. Mar 20, 2026 · Mar 20, 2026
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 19, 2026 · 17d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
  3. Aug 4, 2026 · 22h ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactNone
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →