CVE-2026-33186

criticalpriority · track · 11EPSS 0.016 · 75 %ileexploit · PoCCHDEEUFRNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

1.58% (75th) EPSS

CVSS 9.1 · critical

Is it mine?

81 products

Check your exposure

Who says so?

9 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-23

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.aarch64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.ppc64le as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.s390x as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP7suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-150100.3.63.1.x86_64 as component of openSUSE Leap 15.6suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-6.60.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-6.60.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-6.60.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgoogle-cloud-sap-agent-0:3.12-6.60.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.14.0-150400.4.15.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.14.0-150400.4.15.1.s390x as component of SUSE Linux Enterprise Micro 5.3suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.14.0-150400.4.15.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-dracut-grub2-0:2.14.0-150400.4.15.1.aarch64 as component of SUSE Linux Enterprise Micro 5.3suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-dracut-grub2-0:2.14.0-150400.4.15.1.s390x as component of SUSE Linux Enterprise Micro 5.3suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-dracut-grub2-0:2.14.0-150400.4.15.1.x86_64 as component of SUSE Linux Enterprise Micro 5.3suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.14.0-150300.6.19.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.14.0-150300.6.19.1.s390x as component of SUSE Linux Enterprise Micro 5.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.14.0-150300.6.19.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-dracut-grub2-0:2.14.0-150300.6.19.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-dracut-grub2-0:2.14.0-150300.6.19.1.s390x as component of SUSE Linux Enterprise Micro 5.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-dracut-grub2-0:2.14.0-150300.6.19.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.17.0-150500.3.15.1.aarch64 as component of SUSE Linux Enterprise Micro 5.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.17.0-150500.3.15.1.ppc64le as component of SUSE Linux Enterprise Micro 5.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.17.0-150500.3.15.1.s390x as component of SUSE Linux Enterprise Micro 5.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.17.0-150500.3.15.1.x86_64 as component of SUSE Linux Enterprise Micro 5.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-dracut-grub2-0:2.17.0-150500.3.15.1.aarch64 as component of SUSE Linux Enterprise Micro 5.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-dracut-grub2-0:2.17.0-150500.3.15.1.ppc64le as component of SUSE Linux Enterprise Micro 5.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-dracut-grub2-0:2.17.0-150500.3.15.1.s390x as component of SUSE Linux Enterprise Micro 5.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-dracut-grub2-0:2.17.0-150500.3.15.1.x86_64 as component of SUSE Linux Enterprise Micro 5.5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
FixedLabX Enterprisemettler_toledo_psirt
Update to LabX Enterprise v21.4.25 to address the vulnerability.
FixedLabX Standardmettler_toledo_psirt
Update to LabX Standard v21.4.25 to address the vulnerability.
Fixedazure-storage-azcopy-0:10.32.2-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedazure-storage-azcopy-0:10.32.2-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedazure-storage-azcopy-0:10.32.2-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedazure-storage-azcopy-0:10.32.2-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedrclone-0:1.73.3-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedrclone-0:1.73.3-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedrclone-0:1.73.3-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedrclone-0:1.73.3-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedrclone-bash-completion-0:1.73.3-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedrclone-bash-completion-0:1.73.3-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedrclone-bash-completion-0:1.73.3-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedrclone-bash-completion-0:1.73.3-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedrclone-zsh-completion-0:1.73.3-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedrclone-zsh-completion-0:1.73.3-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedrclone-zsh-completion-0:1.73.3-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedrclone-zsh-completion-0:1.73.3-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedamazon-cloudwatch-agent-0:1.300064.0-2.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedamazon-cloudwatch-agent-0:1.300064.0-2.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedamazon-cloudwatch-agent-0:1.300064.0-2.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedamazon-cloudwatch-agent-0:1.300064.0-2.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgolang-github-v2fly-v2ray-core-0:5.47.0-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgolang-github-v2fly-v2ray-core-0:5.47.0-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgolang-github-v2fly-v2ray-core-0:5.47.0-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedgolang-github-v2fly-v2ray-core-0:5.47.0-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedv2ray-core-0:5.47.0-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedv2ray-core-0:5.47.0-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedv2ray-core-0:5.47.0-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedv2ray-core-0:5.47.0-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.26.0-3.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.26.0-3.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.26.0-3.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedignition-0:2.26.0-3.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-0:1.7.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-0:1.7.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-0:1.7.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-0:1.7.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-bash-completion-0:1.7.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-bash-completion-0:1.7.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-bash-completion-0:1.7.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-bash-completion-0:1.7.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-fish-completion-0:1.7.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-fish-completion-0:1.7.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-fish-completion-0:1.7.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-fish-completion-0:1.7.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-zsh-completion-0:1.7.1-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-zsh-completion-0:1.7.1-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-zsh-completion-0:1.7.1-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedk6-zsh-completion-0:1.7.1-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.1–9.1

v3.19.1criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · security-advisories@github.comexploitability 3.9 · impact 5.2

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondaryexploitability 3.9 · impact 5.2

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · Mettler-Toledo PSIRT

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · SUSE Product Security

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-285USCWE-285USCWE-285USCWE-285USCWE-551USCWE-551US

exploits (1)

Public proof-of-concept and weaponised exploit code.

JohannesLks/CVE-2026-33186gRPC-Go RBAC Authorization Policy Bypass via Missing `:path` Slash (Auth Bypass)PoC · poc_in_github

affected products (81)

Products and version ranges known to be affected.

IBM App Connect Enterpriseall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:-
IBM DB2all versionscert_bundDEcpe:/a:ibm:db2:-
IBM MQ Operatorall versionscert_bundDEcpe:/a:ibm:mq:operator
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux 8all versionscert_bundDEcpe:/o:redhat:enterprise_linux:8
Red Hat Enterprise Linux 9 Multicluster Engine for Kubernetes 2.8.6all versionscert_bundDEcpe:/o:redhat:enterprise_linux:9_multicluster_engine_for_kubernetes_2.8.6
Red Hat Enterprise Linux Edge Managerall versionscert_bundDEcpe:/o:redhat:enterprise_linux:edge_manager
Red Hat OpenShift API for Data Protectionall versionscert_bundDEcpe:/a:redhat:openshift:api_for_data_protection
Red Hat OpenShift Container Platformall versionscert_bundDEcpe:/a:redhat:openshift:container_platform
Red Hat OpenShift Container Platform 4.16all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4.16
Red Hat OpenShift Container Platform 4.18all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4.18
Red Hat OpenShift Container Platform 4.19all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4.19
Red Hat OpenShift Container Platform 4.21.17all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_4.21.17
Red Hat OpenShift Container Platform release 4.21.17all versionscert_bundDEcpe:/a:redhat:openshift:container_platform_release_4.21.17
Red Hat OpenShift Data Foundationall versionscert_bundDEcpe:/a:redhat:openshift:data_foundation
Red Hat OpenShift Service Mesh 2.6all versionscert_bundDEcpe:/a:redhat:openshift:service_mesh_2.6
Red Hat OpenShift Service Mesh 3.0all versionscert_bundDEcpe:/a:redhat:openshift:service_mesh_3.0
Red Hat OpenShift Service Mesh 3.2all versionscert_bundDEcpe:/a:redhat:openshift:service_mesh_3.2

showing 20 of 81

advisories (22)

Vendor and ecosystem advisories describing this.

NCSC-2026-0306Kwetsbaarheden verholpen in Oracle Fusion MiddlewareNL2026-08-19csaf · ncsc_nlNL
Oracle heeft 262 kwetsbaarheden verholpen in diverse Oracle producten, waaronder Oracle WebLogic Server, Oracle Identity Manager, Oracle WebCenter Portal, Oracle WebCenter Content, Oracle WebCenter Sites, Oracle WebCenter Enterprise Capture, Oracle Reports Developer, Oracle Fusion Middleware Helidon, Oracle Access Manager, Oracle Unified Directory, Oracle Virtual Directory, Oracle Internet Directory, Oracle Web Services Manager, Oracle SOA Suite B2B Engine, Oracle Managed File Transfer, en Oracle Identity Manager Connector.
SUSE-SU-2026:1194-1Security update for google-cloud-sap-agent2026-04-07csaf · suse_csafDE
Security update for google-cloud-sap-agent
SUSE-SU-2026:1195-1Security update for google-cloud-sap-agent2026-04-07csaf · suse_csafDE
Security update for google-cloud-sap-agent
SUSE-SU-2026:1197-1Security update for ignition2026-04-07csaf · suse_csafDE
Security update for ignition
SUSE-SU-2026:1198-1Security update for ignition2026-04-07csaf · suse_csafDE
Security update for ignition
SUSE-SU-2026:1200-1Security update for ignition2026-04-07csaf · suse_csafDE
Security update for ignition
VDE-2026-088METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.42026-08-20csaf · mettler_toledo_psirtCH
The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25. The vulnerabilities found in LabX Enterprise versions 21.3.22 - 21.4.23 are CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Enterprise v21.4.25 All other vulnerabilities are to be fixed in the upcoming releases.
WID-SEC-W-2026-1136Red Hat OpenShift Container Platform (gRPC-Go): Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2026-04-15csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift Container Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
WID-SEC-W-2026-1752IBM Business Automation Workflow: Mehrere SchwachstellenDeutsch2026-05-31csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.
WID-SEC-W-2026-2451Oracle Siebel CRM: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Siebel CRM ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-2894Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2026-08-18csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-2929Splunk Splunk Enterprise: Mehrere SchwachstellenDeutsch2026-08-19csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, SQL-Injection-, serverseitige Request-Forgery- und Cross-Site-Scripting-Angriffe durchzuführen, sensible Informationen offenzulegen oder zu manipulieren, Denial-of-Service-Zustände auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.
WID-SEC-W-2026-3046IBM Concert: Mehrere SchwachstellenDeutsch2026-08-26csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.
openSUSE-SU-2026:10407-1azure-storage-azcopy-10.32.2-1.1 on GA media2026-03-23csaf · suse_csafDE
azure-storage-azcopy-10.32.2-1.1 on GA media
openSUSE-SU-2026:10419-1rclone-1.73.3-1.1 on GA media2026-03-24csaf · suse_csafDE
rclone-1.73.3-1.1 on GA media
openSUSE-SU-2026:10420-1amazon-cloudwatch-agent-1.300064.0-2.1 on GA media2026-03-25csaf · suse_csafDE
amazon-cloudwatch-agent-1.300064.0-2.1 on GA media
openSUSE-SU-2026:10432-1golang-github-v2fly-v2ray-core-5.47.0-1.1 on GA media2026-03-25csaf · suse_csafDE
golang-github-v2fly-v2ray-core-5.47.0-1.1 on GA media
openSUSE-SU-2026:10474-1ignition-2.26.0-3.1 on GA media2026-04-01csaf · suse_csafDE
ignition-2.26.0-3.1 on GA media
openSUSE-SU-2026:10484-1k6-1.7.1-1.1 on GA media2026-04-03csaf · suse_csafDE
k6-1.7.1-1.1 on GA media
GHSA-p77j-4mvh-x3m3gRPC-Go has an authorization bypass via missing leading slash in :path2026-03-18ghsa · osvUS
### Impact _What kind of vulnerability is it? Who is impacted?_ It is an **Authorization Bypass** resulting from **Improper Input Validation** of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. **Who is impacted?** This affects gRPC-Go servers that meet both of the following criteria: 1. They use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`. 2. Their security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Yes, the issue has been patched. The fix ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. Users should upgrade to the following versions (or newer): * **v1.79.3** * The latest **master** branch. It is recommended that all users employing path-based authorization (especially `grpc/authz`) upgrade as soon as the patch is available in a tagged release. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: #### 1. Use a Validating Interceptor (Recommended Mitigation) Add an "outermost" interceptor to your server that validates the path before any other authorization logic runs: ```go func pathValidationInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) { if info.FullMethod == "" || info.FullMethod[0] != '/' { return nil, status.Errorf(codes.Unimplemented, "malformed method name") } return handler(ctx, req) } // Ensure this is the FIRST interceptor in your chain s := grpc.NewServer( grpc.ChainUnaryInterceptor(pathValidationInterceptor, authzInterceptor), ) ``` #### 2. Infrastructure-Level Normalization If your gRPC server is behind a reverse proxy or load balancer (such as Envoy, NGINX, or an L7 Cloud Load Balancer), ensure it is configured to enforce strict HTTP/2 compliance for pseudo-headers and reject or normalize requests where the `:path` header does not start with a leading slash. #### 3. Policy Hardening Switch to a "default deny" posture in your authorization policies (explicitly listing all allowed paths and denying everything else) to reduce the risk of bypasses via malformed inputs.
CERTFR-2026-AVI-1366Multiples vulnérabilités dans les produits SplunkFrançais2026-10-22vendor · certfrFR
GO-2026-4762Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc2026-03-27vendor · osvUS
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl suse_csaf mettler_toledo_psirt certfr NVD CVE.org MITRE

published 2026-03-20modified 2026-10-08

references (237)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan