CVE-2026-33186: gRPC-Go has an authorization bypass via missing leading slash in :path

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 1.7%, percentile 77: FIRST’s model estimates a 1.7% chance of exploitation activity in the next 30 days, higher than 77% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
• Only applies if your dependency tree includes google.golang.org/grpc (Go) < 1.79.3, fixed in 1.79.3. Check your lockfile, including transitive dependencies.

What it is

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx); AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

From the GitHub advisory

Impact What kind of vulnerability is it? Who is impacted?

It is an Authorization Bypass resulting from Improper Input Validation of the HTTP/2 :path pseudo-header.

The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present.

Who is impacted? This affects gRPC-Go servers that meet both of the following criteria: 1. They use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx). 2. Their security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule).

The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server.

Weakness type: CWE-285, CWE-551.

Product: google.golang.org/grpc (Go) · Assigned by: GitHub_M · Published: 2026-03-20

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: none (no login)
• User interaction: none
• Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
• FIRST EPSS (model of 2026-10-21): 1.69% probability of exploitation activity in the next 30 days; percentile 77.

Timeline

• 2026-03-18 — GitHub-reviewed advisory GHSA-p77j-4mvh-x3m3 published (critical)
• 2026-03-20 — CVE record published by GitHub_M
• 2026-09-18 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

1. access.redhat.com access.redhat.com
2. access.redhat.com access.redhat.com
3. access.redhat.com access.redhat.com
4. access.redhat.com access.redhat.com
5. access.redhat.com access.redhat.com
6. access.redhat.com access.redhat.com
7. access.redhat.com access.redhat.com
8. access.redhat.com access.redhat.com
9. access.redhat.com access.redhat.com
10. access.redhat.com access.redhat.com
11. access.redhat.com access.redhat.com
12. access.redhat.com access.redhat.com
13. access.redhat.com access.redhat.com
14. access.redhat.com access.redhat.com
15. access.redhat.com access.redhat.com
16. access.redhat.com access.redhat.com
17. access.redhat.com access.redhat.com
18. access.redhat.com access.redhat.com
19. access.redhat.com access.redhat.com
20. access.redhat.com access.redhat.com
21. access.redhat.com access.redhat.com
22. access.redhat.com access.redhat.com
23. access.redhat.com access.redhat.com
24. access.redhat.com access.redhat.com
25. access.redhat.com access.redhat.com
26. access.redhat.com access.redhat.com
27. access.redhat.com access.redhat.com
28. access.redhat.com access.redhat.com
29. access.redhat.com access.redhat.com
30. access.redhat.com access.redhat.com
31. access.redhat.com access.redhat.com
32. access.redhat.com access.redhat.com
33. access.redhat.com access.redhat.com
34. access.redhat.com access.redhat.com
35. access.redhat.com access.redhat.com
36. access.redhat.com access.redhat.com
37. access.redhat.com access.redhat.com
38. access.redhat.com access.redhat.com
39. access.redhat.com access.redhat.com
40. access.redhat.com access.redhat.com
41. access.redhat.com access.redhat.com
42. access.redhat.com access.redhat.com
43. access.redhat.com access.redhat.com
44. access.redhat.com access.redhat.com
45. access.redhat.com access.redhat.com
46. access.redhat.com access.redhat.com
47. access.redhat.com access.redhat.com
48. access.redhat.com access.redhat.com
49. access.redhat.com access.redhat.com
50. access.redhat.com access.redhat.com
51. access.redhat.com access.redhat.com
52. access.redhat.com access.redhat.com
53. access.redhat.com access.redhat.com
54. access.redhat.com access.redhat.com
55. access.redhat.com access.redhat.com
56. access.redhat.com access.redhat.com
57. access.redhat.com access.redhat.com
58. access.redhat.com access.redhat.com
59. access.redhat.com access.redhat.com
60. access.redhat.com access.redhat.com
61. access.redhat.com access.redhat.com
62. access.redhat.com access.redhat.com
63. access.redhat.com access.redhat.com
64. access.redhat.com access.redhat.com
65. access.redhat.com access.redhat.com
66. access.redhat.com access.redhat.com
67. access.redhat.com access.redhat.com
68. access.redhat.com access.redhat.com
69. access.redhat.com access.redhat.com
70. access.redhat.com access.redhat.com
71. access.redhat.com access.redhat.com
72. access.redhat.com access.redhat.com
73. access.redhat.com access.redhat.com
74. access.redhat.com access.redhat.com
75. access.redhat.com access.redhat.com
76. access.redhat.com access.redhat.com
77. access.redhat.com access.redhat.com
78. access.redhat.com access.redhat.com
79. access.redhat.com access.redhat.com
80. access.redhat.com access.redhat.com
81. access.redhat.com access.redhat.com
82. access.redhat.com access.redhat.com
83. access.redhat.com access.redhat.com
84. access.redhat.com access.redhat.com
85. access.redhat.com access.redhat.com
86. access.redhat.com access.redhat.com
87. access.redhat.com access.redhat.com
88. access.redhat.com access.redhat.com
89. access.redhat.com access.redhat.com
90. access.redhat.com access.redhat.com
91. access.redhat.com access.redhat.com
92. access.redhat.com access.redhat.com
93. access.redhat.com access.redhat.com
94. access.redhat.com access.redhat.com
95. access.redhat.com access.redhat.com
96. access.redhat.com access.redhat.com
97. access.redhat.com access.redhat.com
98. access.redhat.com access.redhat.com
99. access.redhat.com access.redhat.com
100. access.redhat.com access.redhat.com
101. access.redhat.com access.redhat.com
102. access.redhat.com access.redhat.com
103. access.redhat.com access.redhat.com
104. access.redhat.com access.redhat.com
105. access.redhat.com access.redhat.com
106. access.redhat.com access.redhat.com
107. access.redhat.com access.redhat.com
108. access.redhat.com access.redhat.com
109. access.redhat.com access.redhat.com
110. access.redhat.com access.redhat.com
111. access.redhat.com access.redhat.com
112. access.redhat.com access.redhat.com
113. access.redhat.com access.redhat.com
114. access.redhat.com access.redhat.com
115. access.redhat.com access.redhat.com
116. access.redhat.com access.redhat.com

Vulnerability records

1. GitHub Advisory GHSA-p77j-4mvh-x3m3 github.com
2. CVE.org record CVE-2026-33186 cve.org
3. NVD entry CVE-2026-33186 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. access.redhat.com access.redhat.com
3. RHBZ#2449833 bugzilla.redhat.com
4. security.access.redhat.com security.access.redhat.com

Critical Go advisories · Today’s Security Digest