CVE-2026-33186

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 9.1EPSS 2%

Published 2026-03-20Updated 2026-04-07

Media 1525PoC

Vulnerability details

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CNAGitHub_M

EPSS score history

Sources

4 links

PoC links are not available for guest users. Login to view them.

CVEShield CVE Organization RedHat Vuln DB NVD Analysis

Profile

CVSS

9.1

EPSS

Published

2026-03-20

Updated

2026-04-07

CNA

GitHub_M

Vendors

grpc

1 product

CPEs

190

cpe:/a:redhat:openshift:4.18::el8

cpe:/a:redhat:openshift:4.18::el9

cpe:/a:redhat:satellite:6.16::el8

cpe:/a:redhat:satellite_capsule:6.16::el8

cpe:/a:redhat:satellite_maintenance:6.16::el8

cpe:/a:redhat:satellite_utils:6.16::el8

cpe:/a:redhat:cryostat:4::el9

cpe:/a:redhat:openstack:17.1

cpe:/a:redhat:openstack:17.1::el9

cpe:/a:redhat:openshift:4.16::el9

cpe:/a:redhat:openshift:4.19::el9

cpe:/a:redhat:satellite:6.16::el9

cpe:/a:redhat:satellite_capsule:6.16::el9

cpe:/a:redhat:satellite_maintenance:6.16::el9

cpe:/a:redhat:satellite_utils:6.16::el9

cpe:/o:redhat:enterprise_linux_eus:10.0

cpe:/o:redhat:enterprise_linux:10.2

cpe:/a:redhat:enterprise_linux:8::appstream

cpe:/a:redhat:rhel_eus:9.4::appstream

cpe:/a:redhat:rhel_eus:9.6::appstream

cpe:/a:redhat:enterprise_linux:9::appstream

cpe:/a:redhat:rhel_eus:9.6::crb

cpe:/a:redhat:enterprise_linux:9::crb

cpe:/a:redhat:devworkspace:0.40::el9

cpe:/a:redhat:multicluster_globalhub:1.3::el9

cpe:/a:redhat:multicluster_globalhub:1.4::el9

cpe:/a:redhat:multicluster_globalhub:1.5::el9

cpe:/a:redhat:multicluster_globalhub:1.6::el9

cpe:/a:redhat:network_observ_optr:1.11::el9

cpe:/a:redhat:openshift_api_data_protection:1.4::el9

cpe:/a:redhat:openshift_api_data_protection:1.5::el9

cpe:/a:redhat:openshift_compliance_operator:1::el9

cpe:/a:redhat:acm:2.13::el9

cpe:/a:redhat:acm:2.14::el9

cpe:/a:redhat:acm:2.15::el9

cpe:/a:redhat:acm:2.16::el9

cpe:/a:redhat:advanced_cluster_security:4.10::el8

cpe:/a:redhat:advanced_cluster_security:4.8::el8

cpe:/a:redhat:advanced_cluster_security:4.9::el8

cpe:/a:redhat:container_native_virtualization:4.18::el9

cpe:/a:redhat:container_native_virtualization:4.19::el9

cpe:/a:redhat:container_native_virtualization:4.20::el9

cpe:/a:redhat:container_native_virtualization:4.21::el9

cpe:/a:redhat:rhdh:1.8::el9

cpe:/a:redhat:rhdh:1.9::el9

cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9

cpe:/a:redhat:openshift_ai:2.25::el9

cpe:/a:redhat:openshift_ai:3.3::el9

cpe:/a:redhat:openshift_builds:1.6::el9

cpe:/a:redhat:openshift_builds:1.7::el9

cpe:/a:redhat:openshift:4.12::el9

cpe:/a:redhat:openshift:4.13::el9

cpe:/a:redhat:openshift:4.14::el9

cpe:/a:redhat:openshift:4.15::el9

cpe:/a:redhat:openshift:4.17::el9

cpe:/a:redhat:openshift:4.20::el9

cpe:/a:redhat:openshift:4.21::el9

cpe:/a:redhat:openshift_devspaces:3.27::el9

cpe:/a:redhat:openshift_gitops:1.18::el8

cpe:/a:redhat:openshift_gitops:1.19::el8

cpe:/a:redhat:openshift_pipelines:1.21::el9

cpe:/a:redhat:openshift_pipelines:1.20::el9

cpe:/a:redhat:service_mesh:2.6::el8

cpe:/a:redhat:service_mesh:3.0::el9

cpe:/a:redhat:service_mesh:3.1::el9

cpe:/a:redhat:service_mesh:3.2::el9

cpe:/a:redhat:service_mesh:3.3::el9

cpe:/a:redhat:openshift_distributed_tracing:3.9::el9

cpe:/a:redhat:openshift_data_foundation:4.16::el9

cpe:/a:redhat:openshift_data_foundation:4.18::el9

cpe:/a:redhat:openshift_data_foundation:4.19::el9

cpe:/a:redhat:openshift_data_foundation:4.20::el9

cpe:/a:redhat:quay:3.12::el8

cpe:/a:redhat:quay:3.14::el8

cpe:/a:redhat:quay:3.15::el8

cpe:/a:redhat:quay:3.16::el9

cpe:/a:redhat:quay:3.17::el9

cpe:/a:redhat:quay:3.10::el8

cpe:/a:redhat:quay:3.9::el8

cpe:/a:redhat:trusted_artifact_signer:1.3::el9

cpe:/a:redhat:webterminal:1.13::el9

cpe:/a:redhat:webterminal:1.14::el9

cpe:/a:redhat:webterminal:1.15::el9

cpe:/a:redhat:multicluster_engine:2.10::el9

cpe:/a:redhat:multicluster_engine:2.11::el9

cpe:/a:redhat:multicluster_engine:2.6::el8

cpe:/a:redhat:multicluster_engine:2.8::el9

cpe:/a:redhat:multicluster_engine:2.9::el9

cpe:/a:redhat:assisted_installer:2

cpe:/a:redhat:cert_manager:1

cpe:/a:redhat:cryostat:4

cpe:/a:redhat:deployment_validator_operator

cpe:/a:redhat:dynamic_accelerator_slicer:1

cpe:/a:redhat:ext_dns_optr:1

cpe:/a:redhat:openshift_file_integrity_operator:1

cpe:/a:redhat:gatekeeper:3

cpe:/a:redhat:job_set:0

cpe:/a:redhat:kernel_module_management:2

cpe:/a:redhat:kube_descheduler_operator:4

cpe:/a:redhat:leader_worker_set:1

cpe:/a:redhat:logging:5

cpe:/a:redhat:lvms:4

cpe:/a:redhat:migration_toolkit_applications:8

cpe:/a:redhat:rhmt:1

cpe:/a:redhat:migration_toolkit_virtualization:2

cpe:/a:redhat:multicluster_engine

cpe:/a:redhat:multicluster_globalhub

cpe:/a:redhat:openshift_api_data_protection:1

cpe:/a:redhat:ocp_tools

cpe:/a:redhat:openshift_lightspeed

cpe:/a:redhat:openshift_pipelines:1

cpe:/a:redhat:run_once_duration_override_operator:1

cpe:/a:redhat:openshift_secondary_scheduler:1

cpe:/a:redhat:serverless:1

cpe:/a:redhat:service_mesh:2

cpe:/a:redhat:acm:2

cpe:/a:redhat:ai_inference_server:3

cpe:/a:redhat:ansible_automation_platform:2

cpe:/a:redhat:podman_desktop:1

cpe:/a:redhat:podman_desktop:0

cpe:/a:redhat:certifications:9

cpe:/a:redhat:connectivity_link:1

cpe:/a:redhat:edge_manager:1

cpe:/o:redhat:enterprise_linux:10

cpe:/o:redhat:enterprise_linux:7

cpe:/o:redhat:enterprise_linux:8

cpe:/o:redhat:enterprise_linux:9

cpe:/a:redhat:enterprise_linux_ai:3

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:openshift_cluster_manager_cli:1

cpe:/a:redhat:openshift:4

cpe:/a:redhat:openshift_data_foundation:4

cpe:/a:redhat:openshift_gitops:1

cpe:/a:redhat:container_native_virtualization:4

cpe:/a:redhat:openstack:16.2

cpe:/a:redhat:quay:3

cpe:/a:redhat:satellite:6

cpe:/a:redhat:trusted_artifact_signer:1

cpe:/a:redhat:openshift_security_profiles_operator:1

cpe:/a:redhat:workload_availability_snr:0

cpe:/a:redhat:workload_availability_sbr:0

cpe:/a:redhat:zero_trust_workload_identity_manager:0

cpe:/a:redhat:openshift_builds:1

cpe:/a:redhat:confidential_compute_attestation:1

cpe:/a:redhat:openshift_custom_metrics_autoscaler:2

cpe:/a:redhat:external_secrets_operator:1

cpe:/a:redhat:workload_availability_mdr:0

cpe:/a:redhat:service_mesh:3

cpe:/a:redhat:openshift_power_monitoring

cpe:/a:redhat:red_hat_3scale_amp:2

cpe:/a:redhat:kueue_operator:1

cpe:/a:redhat:devworkspace

cpe:/a:redhat:windows_machine_config

cpe:/a:redhat:openstack:18.0

cpe:/a:redhat:service_interconnect:1

cpe:/a:redhat:trusted_profile_analyzer:2

cpe:/a:redhat:stf:1.5

cpe:/a:redhat:zero_trust_workload_identity_manager:1

cpe:/a:redhat:openshift:4.16::el8

cpe:/a:redhat:logging:6.4::el9

cpe:/a:redhat:openshift:4.22::el9

cpe:/a:redhat:openshift:4.17::el8

cpe:/a:redhat:edge_manager:1.0::el9

cpe:/a:redhat:enterprise_linux:8

cpe:/a:redhat:enterprise_linux:9

cpe:/a:redhat:rhel_eus:9.4

cpe:/a:redhat:rhel_eus:9.6

cpe:/a:redhat:kube_descheduler_operator:5

cpe:/a:redhat:edge_manager:1.1::el9

cpe:/a:redhat:edge_manager:1.1::el10

cpe:/a:redhat:edge_manager:1.1:el9

cpe:/a:redhat:satellite:6.17::el9

cpe:/a:redhat:satellite:6.18::el9

cpe:/a:redhat:satellite:6.19::el9

cpe:/a:redhat:rhmt:1.8::el8

cpe:/a:redhat:openshift_api_data_protection:1.6::el9

cpe:/a:redhat:logging:6.2::el9

cpe:/a:redhat:openshift:4.15::el8

cpe:/a:redhat:logging:6.0::el9

cpe:/a:redhat:openshift_api_data_protection:1.3::el9

cpe:/a:redhat:container_native_virtualization:4.16::el9

cpe:/o:redhat:rhel_els:7

cpe:/a:redhat:workload_availability_far:0

cpe:/a:redhat:cert_manager:1.19::el9

cpe:/a:redhat:workload_availability_sbr:0.3::el9

cpe:/a:redhat:workload_availability_far:0.8::el9

cpe:/a:redhat:openstack:16.2::el8

cpe:/a:redhat:rhel_e4s:9.4

cpe:/a:redhat:container_native_virtualization:4.22::el9

cpe:/a:redhat:rhel_e4s:9.2

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated