CVE-2026-33186 - Vulnerability Analysis

Overview

gRPC-Go < 1.79.3 contains an authorization bypass caused by improper validation of HTTP/2 :path pseudo-header missing leading slash, letting attackers bypass path-based authorization policies, exploit requires sending malformed :path headers.

Severity & Score

Impact

Attackers can bypass authorization policies, potentially gaining unauthorized access to protected gRPC methods.

Mitigation

Upgrade to version 1.79.3 or later; alternatively use validating interceptors, infrastructure-level normalization, or policy hardening.

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner