CVE-2026-33186 - Vulnerability Analysis

Overview

gRPC-Go < 1.79.3 contains an authorization bypass caused by improper validation of HTTP/2 :path pseudo-header missing leading slash, letting attackers bypass path-based authorization policies, exploit requires sending malformed :path headers.

Severity & Score

Impact

Attackers can bypass authorization policies, potentially gaining unauthorized access to protected gRPC methods.

Mitigation

Upgrade to version 1.79.3 or later; alternatively use validating interceptors, infrastructure-level normalization, or policy hardening.

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 22, 2026

🔴 CVE-2026-33186 - Critical (9.1) gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepti... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33186/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner