gRPC-Go has an authorization bypass via missing leading slash in :path

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

• CVE-2026-33186: 1.58% estimated exploitation activity in the next 30 days; percentile 75.60 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact What kind of vulnerability is it? Who is impacted? It is an Authorization Bypass resulting from Improper Input Validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. Who is impacted? This affects gRPC-Go servers that meet both of the following criteria: 1. They use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or…

Published by the source

18 Mar 2026, 20:10 UTC

Last modified by the source

25 Mar 2026, 18:12 UTC

Source last checked

26 Oct 2026, 15:18 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-p77j-4mvh-x3m3

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-33186

Advisory: gRPC-Go has an authorization bypass via missing leading slash in :path
IDs: CVE-2026-33186, GHSA-p77j-4mvh-x3m3
Record: https://patchnext.com/advisories/cve-2026-33186 (revision 1, source checked 26 Oct 2026, 15:18 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Critical (CVSS 9.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: google.golang.org/grpc 1.79.3. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go google.golang.org/grpc: affected < 1.79.3; fixed in 1.79.3

## Suggested inspection (read-only)
- Go google.golang.org/grpc: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on google.golang.org/grpc.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-p77j-4mvh-x3m3 (GitHub-reviewed advisory GHSA-p77j-4mvh-x3m3 lists affected ranges: Go google.golang.org/grpc >=0 <1.79.3)

Commands are suggestions: review each one before running it.