# CVE-2026-33186

## Summary

- **CVE ID:** CVE-2026-33186
- **Severity:** CRITICAL
- **CVSS Score:** 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
- **CWE:** CWE-285
- **Published:** Mar 20, 2026
- **Last Modified:** Sep 18, 2026

## Description

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

## Affected Products

- grpc — grpc-go (< 1.79.3)
- go — google.golang.org/grpc (< 1.79.3)

## References

- [CNA](https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3)
- [GitHub](https://github.com/advisories/GHSA-p77j-4mvh-x3m3)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2026-33186)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2449833)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33186.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26997)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27076)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:17789)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28047)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20436)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:18068)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20322)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26999)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19719)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27856)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22937)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19135)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22450)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10107)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19721)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19720)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27712)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10705)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10706)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23228)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19353)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22714)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19207)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:9872)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22423)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22347)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21769)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23345)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:6428)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:29854)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26568)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8433)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22645)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25127)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:13548)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8151)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:11408)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:11803)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:13829)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7110)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:11070)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7128)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:13791)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27893)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27901)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27957)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27892)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:6174)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:6802)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22485)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24977)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10698)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19712)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10155)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10158)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21696)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21697)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:12283)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21691)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21692)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25009)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:15092)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23234)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23235)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:14775)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25045)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20088)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20089)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10105)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:17598)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:17599)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21657)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25182)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21658)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27001)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:17448)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25183)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:12119)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:12118)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8449)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23246)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20041)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20042)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27004)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23247)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25201)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10093)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10094)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21703)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27063)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:17468)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24535)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21704)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25195)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25194)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:6564)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24759)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:17474)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21709)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24506)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20034)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20035)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25187)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:7245)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:23241)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:17475)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21710)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22800)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10175)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20946)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20943)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26519)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24484)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21932)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21931)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8483)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:9440)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8484)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:9448)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8490)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:9453)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8491)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8493)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:9388)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:9385)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26416)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26420)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26413)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:12279)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:26412)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:12277)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:11856)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21017)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24853)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19375)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22465)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:11916)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:11996)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10131)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10125)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10130)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10126)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10172)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:10153)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8338)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22959)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22961)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24536)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19099)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:12116)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:12337)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19108)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:17459)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:17123)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:22689)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:18585)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19109)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:29079)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:29082)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34364)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28893)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:28964)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34769)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34794)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34795)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34097)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36796)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36882)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36651)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34049)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34099)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37275)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34100)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37585)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37192)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:37580)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40118)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36611)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36621)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40984)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41019)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40945)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42150)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42151)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42240)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41928)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42644)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40795)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40792)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41941)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41944)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42051)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:42049)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:43692)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40022)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40030)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:47952)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:43253)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:43227)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:44233)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:44235)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:43331)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:43225)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:48790)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:50843)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:51033)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:47728)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:48699)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54191)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:53804)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:53773)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:53763)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:53728)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:50758)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54286)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54274)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54757)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:54531)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56431)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56366)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56959)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:57013)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56789)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:57365)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:60146)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56912)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:56854)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:61245)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59833)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 1.56%
- **EPSS Percentile:** 73.9

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._