---
title: "CVE-2026-33186: gRPC-Go has an authorization bypass via missing leading slash in :path"
url: https://erroneo.us/security/cve/CVE-2026-33186/
description: "CVE-2026-33186 (google.golang.org/grpc (Go)): gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-03-20
date_modified: 2026-09-18
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-33186"
kev: false
cvss: 9.1
epss: 0.01688
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-33186: gRPC-Go has an authorization bypass via missing leading slash in :path

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 1.7% , percentile 77: FIRST’s model estimates a 1.7% chance of exploitation activity in the next 30 days, higher than 77% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes google.golang.org/grpc (Go) < 1.79.3, fixed in 1.79.3 . Check your lockfile, including transitive dependencies.

## What it is

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx); AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

## Affected packages

- Go `google.golang.org/grpc` < 1.79.3 → fixed: 1.79.3

## Affected products (CVE record)

- grpc grpc-go: < 1.79.3

## Severity

- GitHub_M CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
- redhat-SADP CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
- GitHub CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact partial .
- FIRST EPSS (model of 2026-10-21): 1.69% probability of exploitation activity in the next 30 days; percentile 77.

## Sources

- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:41019)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:54191)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:54757)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:43225)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:29079)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:34097)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:26997)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:27076)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:17789)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36796)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:28047)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:20436)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:18068)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:20322)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:26999)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:42150)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:42151)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:42240)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:19719)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:27856)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:22937)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:19135)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:22450)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:48790)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:10107)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:61245)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:56959)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:19721)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:19720)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:27712)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:10705)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:10706)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:23228)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:19353)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:22714)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:19207)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:10155)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:54531)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:8433)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:9872)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:34364)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:47952)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:50843)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:22423)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:22347)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:23345)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:6428)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:51033)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:29854)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:26568)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:43692)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:22645)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36882)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:25127)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:13548)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:8151)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:11408)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:11803)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:7110)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:11070)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:7128)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:13791)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:13829)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:53804)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:27893)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:53773)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:27901)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:27957)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:53763)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:27892)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:53728)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:60146)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:6174)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:6802)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36651)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:40945)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:40118)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:22485)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:41928)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:24977)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:10698)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:42644)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:37275)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:19712)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:10158)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:59833)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:40030)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:21696)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:34049)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:21697)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:12283)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:40022)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:21691)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:21692)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:56789)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:43253)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:28893)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36611)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:25009)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:15092)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:56912)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:43227)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:23234)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:28964)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:23235)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:14775)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:43331)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:25045)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:50758)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:29082)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:36621)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:56854)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:20088)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:20089)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:10105)
- [access.redhat.com](https://access.redhat.com/errata/RHSA-2026:34099)
- [GitHub Advisory GHSA-p77j-4mvh-x3m3](https://github.com/advisories/GHSA-p77j-4mvh-x3m3)
- [CVE.org record CVE-2026-33186](https://www.cve.org/CVERecord?id=CVE-2026-33186)
- [NVD entry CVE-2026-33186](https://nvd.nist.gov/vuln/detail/CVE-2026-33186)
- [github.com](https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3)
- [access.redhat.com](https://access.redhat.com/security/cve/CVE-2026-33186)
- [RHBZ#2449833](https://bugzilla.redhat.com/show_bug.cgi?id=2449833)
- [security.access.redhat.com](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33186.json)

---
Source page: https://erroneo.us/security/cve/CVE-2026-33186/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt