CVE-2026-33186

Fixed in a distro release EPSS 2%CVSS 9.1

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Published 2026-03-20 · CVE record · OSV

Products: grpc-go, Red Hat Cryostat 4 on RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.19, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1 for RHEL 9, Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9, Red Hat Satellite 6.18 for RHEL 9, Red Hat Satellite 6.19 for RHEL 9, Red Hat RHEM 1.0 for RHEL 9, Red Hat RHEM 1.1 for RHEL 10, Red Hat RHEM 1.1 for RHEL 9, Builds for Red Hat OpenShift 1.6.0, Cert Manager support for Red Hat OpenShift release 1.19, Red Hat Compliance Operator 1, Red Hat DevWorkspace Operator 0.4, Logging for Red Hat OpenShift 6, Logging for Red Hat OpenShift 6.2, Logging Subsystem for Red Hat OpenShift 6.4, Red Hat multicluster engine for Kubernetes 2.1, Red Hat multicluster engine for Kubernetes 2.11, Red Hat multicluster engine for Kubernetes 2.6, Red Hat multicluster engine for Kubernetes 2.8, Red Hat multicluster engine for Kubernetes 2.9, Red Hat Multicluster Global Hub 1.3.4, Red Hat Multicluster Global Hub 1.4.5, Red Hat Multicluster Global Hub 1.6.5, Red Hat Network Observability (NETOBSERV) 1.11.0, Red Hat OpenShift API for Data Protection 1.3, Red Hat OpenShift API for Data Protection 1.4, Red Hat OpenShift API for Data Protection 1.5, Red Hat OpenShift API for Data Protection 1.6, Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat Advanced Cluster Management for Kubernetes 2.14, Red Hat Advanced Cluster Management for Kubernetes 2.15, Red Hat Advanced Cluster Management for Kubernetes 2.16, Red Hat Advanced Cluster Security 4.8, Red Hat Advanced Cluster Security 4.9, Red Hat Advanced Cluster Security for Kubernetes 4.10, Red Hat Container Native Virtualization 4.16, Red Hat Container Native Virtualization 4.18, Red Hat Container Native Virtualization 4.19, Red Hat Container Native Virtualization 4.20, Red Hat Container Native Virtualization 4.21, Red Hat Container Native Virtualization 4.22, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat Edge Manager 1.0, Red Hat Edge Manager 1.1, Red Hat Lightspeed (formerly Insights) for Runtimes 1.0, Red Hat Migration Toolkit 1.8, Red Hat multicluster global hub 1.5.3, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat OpenShift Builds 1.7.3, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift Container Platform 4.21, Red Hat OpenShift Container Platform 4.22, Red Hat Openshift Data Foundation 4.16, Red Hat Openshift Data Foundation 4.18, Red Hat Openshift Data Foundation 4.19, Red Hat Openshift Data Foundation 4.20, Red Hat OpenShift Dev Spaces 3.27, Red Hat OpenShift distributed tracing 3.9.3, Red Hat OpenShift GitOps 1.18, Red Hat OpenShift GitOps 1.19, Red Hat OpenShift Pipelines 1.2, Red Hat OpenShift Pipelines 1.21, Red Hat OpenShift Service Mesh 2.6, Red Hat OpenShift Service Mesh 3.0, Red Hat OpenShift Service Mesh 3.1, Red Hat OpenShift Service Mesh 3.2, Red Hat OpenShift Service Mesh 3.3, Red Hat OpenShift Workload Availability 0.3, Red Hat OpenShift Workload Availability 0.8, Red Hat Quay 3.10, Red Hat Quay 3.12, Red Hat Quay 3.14, Red Hat Quay 3.15, Red Hat Quay 3.16, Red Hat Quay 3.17, Red Hat Quay 3.9, Red Hat Trusted Artifact Signer 1.3, Red Hat Web Terminal 1.13, Red Hat Web Terminal 1.14, Red Hat Web Terminal 1.15, Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Red Hat Confidential Compute Attestation, Red Hat Cryostat 4, Custom Metric Autoscaler operator for Red Hat Openshift, Red Hat Deployment Validation Operator, Dynamic Accelerator Slicer Operator for Red Hat OpenShift, Red Hat ExternalDNS Operator, External Secrets Operator for Red Hat OpenShift, Red Hat File Integrity Operator, Red Hat Gatekeeper 3, Red Hat Job Set Tech Preview, Kernel Module Management Operator for Red Hat Openshift, Red Hat Kube Descheduler Operator, Red Hat Leader Worker Set, Logging Subsystem for Red Hat OpenShift, Red Hat Logical Volume Manager Storage, Red Hat Machine Deletion Remediation Operator, Red Hat Migration Toolkit for Applications 8, Red Hat Migration Toolkit for Containers, Red Hat Migration Toolkit for Virtualization, Red Hat Multicluster Engine for Kubernetes, Red Hat Multicluster Global Hub, Red Hat OpenShift Developer Tools and Services, Red Hat OpenShift Lightspeed, Red Hat OpenShift Pipelines, Red Hat OpenShift Run Once Duration Override Operator, Red Hat OpenShift Secondary Scheduler Operator, Red Hat OpenShift Serverless, Red Hat OpenShift Service Mesh 2, Red Hat OpenShift Service Mesh 3, Power monitoring for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Build of Kueue, Red Hat Build of Podman Desktop, Red Hat Build of Podman Desktop - Tech Preview, Red Hat Certification Program for Red Hat Enterprise Linux 9, Red Hat Connectivity Link 1, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Cluster Manager CLI, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4, Red Hat OpenShift Dev Workspaces Operator, Red Hat OpenShift for Windows Containers, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0, Red Hat Quay 3, Red Hat Satellite 6, Red Hat Service Interconnect 1, Red Hat Trusted Artifact Signer, Red Hat Trusted Profile Analyzer, Red Hat Security Profiles Operator, Red Hat Self Node Remediation Operator, Red Hat Service Telemetry Framework 1.5, Red Hat Storage-Based Remediation, Red Hat Zero Trust Workload Identity Manager, Red Hat Zero Trust Workload Identity Manager - Tech Preview

Fixed upstream

Distro releases