CVE-2026-33186 — Improper Authorization in Grpc-go

CWE-285 — Improper AuthorizationCWE-1395 — Dependency on Vulnerable Third-Party ComponentCWE-551 — Incorrect Behavior Order: Authorization Before Parsing and Canonicalization14 documents9 sources
Severity
9.1CRITICALNVD
EPSS
0.0%
top 96.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Grpc Grpc-goGithub.com Traefik Traefik V2Github.com Traefik Traefik V3+2 more
Timeline
PublishedMar 20
Latest updateApr 2

Description

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages5 packages

▶NVDgrpc/grpc< 1.79.3
▶CVEListV5grpc/grpc-go< 1.79.3
▶Gogithub.com/traefik_traefik_v33.0.0-beta3 — 3.6.12+1

🔴Vulnerability Details

8
OSV
Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186) in github.com/traefik/traefik↗2026-04-02
▶
GHSA
Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)↗2026-03-29
▶
OSV
Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)↗2026-03-29
▶
OSV
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc↗2026-03-27
▶
OSV
CVE-2026-33186: gRPC-Go is the Go language implementation of gRPC↗2026-03-20
▶

📋Vendor Advisories

3
Red Hat
google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation↗2026-03-20
▶
Microsoft
gRPC-Go has an authorization bypass via missing leading slash in :path↗2026-03-10
▶
Debian
CVE-2026-33186: golang-google-grpc - gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-33186 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

1
Bugzilla
CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation↗2026-03-20
▶
CVE-2026-33186 — Improper Authorization in Grpc Grpc-go | cvebase