CVE-2026-33186
gRPC-Go is the Go language implementation of gRPC.
Published Mar 20, 2026 · corrected/updated Sep 18, 2026 · Red Hat grpc · evidence confidence high
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the omitted the mandatory leading slash (e.g., instead of ). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with ) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in or custom interceptors relying on or ; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a that does not start with a leading slash is immediately rejected with a error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.
Grounded briefings
Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.
Executive
CVE-2026-33186 is a critical public vulnerability record for Red Hat grpc. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.
System administrator
Identify whether Red Hat grpc is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: grpc/grpc. Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.
Security analyst
Signals on file: CVSS 9.1. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-285, CWE-551. Sources contributing to this record: csaf, cve_org, nvd. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.
Exploitation and remediation
Exploitation evidence
Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.
Patch and remediation
No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.
Code
The project this record applies to. Exploit listings stay in References.
Related Odoo Git fixes
Quoted Community commit messages that cite this CVE. Presence of a commit is not proof that every edition or backport includes the fix. Enterprise proprietary diffs are never shown here. Timeline
Jul 20, 2026 · referenced
Update google.golang.org/grpc to v1.82.1
Update google.golang.org/grpc to v1.82.1 This release fixes three security issues in grpc-go. - A gRPC server now stops reading from a connection when a peer sends too many HTTP/2 control frames. Before this change, a peer could flood a server with control frames and make it use too much memory and CPU. See grpc/grpc-go#9236. There is no fixed v1.81.x release. - The GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING environment variable is removed. Setting it turned strict path checking off and brought back the authorization bypass from CVE-2026-33186. - The old gzip Decompressor API now limits how much data it decompresses, so a small compressed message can no longer use an unbounded amount of memory. Kubernetes does not call this API. The update does not change any other dependency. Kubernetes already requires newer versions of everything grpc v1.82.1 needs, so the ven…
https://github.com/kubernetes/kubernetes/commit/bf2712d71b395db54097b5ae40f1383fe979e384
Timeline
Detection, updates, and resolution for this record.
Mar 20, 2026 · NIST NVD
Detected
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the omitted the mandatory leading slash (e.g., instead of ). While the server successfully routed these requests to the correct handler, author
Sep 18, 2026 · NIST NVD
Updated
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the omitted the mandatory leading slash (e.g., instead of ). While the server successfully routed these requests to the correct handler, author
Affected
- cpe grpc/grpcversion unspecified
Sources
- CSAF AdvisoriesVendor advisoryRHSA-2026:9872:CVE-2026-33186
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed that omits the ma
security.access.redhat.com - CVE.orgVulnerability recordCVE-2026-33186
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33186
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the omi
nvd.nist.gov