CVE-2026-33186Patch(grpc / grpc)

CRITICALCVSS 9.1 · CRITICAL

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Patch grpc grpc systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

grpc CVEs Back to dashboard

8.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3

Other references

Weakness type (CWE)

CWE-285CWE-551

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

grpc

Threat summary

Active exploitation appears in 1 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
23 mentions across 19 observed days

What's happening

Active exploitation reported across 1 signal
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 4 signals
Patch or workaround mentioned in 12 signals
Technical details provided in 19 signals
Disclosure: 9 classified signals
General: 1 classified signal
Peaked 17d ago at 3 mentions (2026-03-20); latest day: 2
23 total mentions across 19 days

Affected systems

Vendors

grpc

Products

grpc

Deep dive

Activity timeline23 mentions / 19d

Signal classification5 categories

Patch

1147.8%

Disclosure

939.1%

General

14.3%

PoC

14.3%

Active Exploitation

14.3%

Referenced assets20 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-19	1	Disclosure1
2026-03-20	3	Disclosure1Patch2
2026-03-21	1	Patch1
2026-03-23	2	General1Patch1
2026-03-24	1	Disclosure1
2026-03-26	1	Disclosure1
2026-03-30	1	Disclosure1
2026-04-03	1	Disclosure1
2026-04-06	1	Disclosure1
2026-04-08	1	PoC1
2026-04-17	1	Patch1
2026-06-01	1	Active Exploitation1
2026-06-09	1	Disclosure1
2026-06-11	1	Patch1
2026-06-12	1	Patch1
2026-06-20	1	Patch1
2026-06-24	1	Disclosure1
2026-06-26	1	Patch1
2026-09-09	2	Patch2

Full discourse20 posts

Gray Hats@the_yellow_fall201d
Patch
A critical 9.1 CVSS flaw in gRPC-Go (CVE-2026-33186) allows attackers to bypass authorization by omitting a leading slash. Upgrade to v1.79.3 immediately. #gRPC #Golang #CyberSecurity #InfoSec #CVE #BugBounty #AppSec #TechNews #CloudNative #Vulnerability https://securityonline.info/grpc-go-authorization-bypass-missing-slash-cve-2026-33186/ https://t.co/P8UXusiHHz
Post summary
The post highlights a critical authorization bypass flaw in gRPC-Go (CVE-2026-33186) and urges users to upgrade to version 1.79.3 to mitigate the risk.
06120122.6K
10.9K followersView on X
Shivasurya@sshivasurya191d
Disclosure
Dropping a new blog post: CVE-2026-33186: Bypassing gRPC-Go Authorization with a Missing Slash https://codepathfinder.dev/blog/cve-2026-33186-grpc-go-authorization-bypass-malformed-path-header
Post summary
The blog post announces a new CVE (CVE‑2026‑33186) describing an authorization bypass in gRPC‑Go due to a malformed path; no proof of concept, exploit code, active exploitation, or patch is mentioned.
01021183
711 followersView on X
Ferramentas Linux@Cezar_H_Linux106d
Patch
🚨 SUSE-SU-2026:2640-1: atualização CRÍTICA para containerd corrige 4 CVEs (CVE-2026-33186, 33814, 34986, 39821), incluindo bypass de autorização e DoS via HTTP/2 Saiba mais: -> http://tinyurl.com/4hzbyfy6 https://t.co/wol5XAdBx1
Post summary
SUSE releases a critical patch for containerd that fixes four CVEs, including an authorization bypass and a DoS via HTTP/2, with further details provided via link.
1100080
1.5K followersView on X
Autumn Good@autumn_good_35187d
Disclosure
🚨🚨🚨 『The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server.』 CVE-2026-33186 gRPC-Go has an authorization bypass via missing leading slash in :path https://github.com/advisories/GHSA-p77j-4mvh-x3m3
Post summary
CVE-2026-33186 is a gRPC-Go authorization bypass due to missing leading slash in :path headers, disclosed via a GitHub advisory with no PoC, exploit, or patch mentioned in the snippet.
10001354
6.8K followersView on X
GCP Weekly@gcpweekly31d
Patch
Specify the channel name on the command line when running conda install (for example: conda install <packages> -c conda-forge ). google-guest-agent upgraded: Upgraded google-guest-agent on Debian and Rocky Linux images (remediating CVE-2026-33186) 6/13
Post summary
The message reports an update to google-guest-agent aimed at remediating CVE-2026-33186 on Debian and Rocky Linux images.
1000033
1.8K followersView on X
GCP Weekly@gcpweekly31d
Patch
Specify the channel name on the command line when running conda install (for example: conda install <packages> -c conda-forge ). google-guest-agent upgraded: Upgraded google-guest-agent on Debian and Rocky Linux images (remediating CVE-2026-33186) 12/13
Post summary
Google has upgraded google‑guest‑agent on Debian and Rocky Linux images to apply a fix for CVE‑2026‑33186. The post confirms a vendor patch but lacks exploit details.
1000047
1.8K followersView on X
Ferramentas Linux@Cezar_H_Linux113d
Patch
5 vulnerabilidades críticas no Azure Storage AzCopy para o #SUSE foram corrigidas na versão 10.32.4. CVE-2026-33186 tem CVSS 9.1! Saiba mais: -> http://tinyurl.com/4dzuk356 https://t.co/RsE7X6NYF9
Post summary
The post informs SUSE users that five critical Azure Storage AzCopy vulnerabilities – including CVE-2026-33186 – were addressed in version 10.32.4, and directs readers to a link for more information.
1000065
1.5K followersView on X
ThreatCluster@threatcluster122d
Patch
SUSE released security fixes for CVE-2026-33186 in google-osconfig-agent (authorisation bypass, CVSS 9.1) and CVE-2026-33814 in google-cloud-sap-agent (HTTP/2 DoS, CVSS 7.5) affecting Public Cloud Module 12, according to SUSE advisories. https://threatcluster.io/cluster/suse-fixes-critical-authorization-bypass-and-dos-vulnerabili-f3c14e34
Post summary
SUSE has issued security fixes for CVE-2026-33186 and CVE-2026-33814, addressing an authorization bypass and an HTTP/2 DoS in Public Cloud Module 12. No PoC, exploit code, or evidence of active exploitation is mentioned.
0001079
327 followersView on X
VulDB 🛡@vuldb201d
General
Some increased actor activities are shown targeting grpc grpc-go (CVE-2026-33186) https://vuldb.com/?ctiid.352149
Post summary
The text notes CVE-2026-33186 is being targeted by increased actor activity and provides a VULDB link, but offers no detailed technical, exploit, or mitigation information.
0000177
2.1K followersView on X
DevOps Daily@thedevopsdaily108d
Disclosure
📝 The gRPC-Go Auth Bypass Hiding in Your Dependency Tree: CVE-2026-33186 A missing leading slash lets requests slip past gRPC-Go authorization rules. It is a CVSS 9.1, it is https://devops-daily.com/posts/grpc-go-authorization-bypass-cve-2026-33186 #DevOps #Security
Post summary
A new gRPC‑Go authorization bypass (CVE‑2026‑33186) has been disclosed, involving a missing leading slash that enables legitimate requests to evade authentication checks, with a CVSS score of 9.1.
0000045
103 followersView on X
nivelepsilon@FpeSre121d
Patch
gRPC-Go CVE-2026-33186, CVSS 9.1 ▶︎ drop the leading slash from :path, bypass every deny rule in your interceptor. Kubernetes cluster-autoscaler v1.35.0 ships unfixed and upgrading it alone won't help. Pin grpc to v1.79.3. 🔓 #Kubernetes #CVE https://github.com/advisories/GHSA-p77j-4mvh-x3m3
Post summary
CVE‑2026‑33186 is a high‑severity gRPC vulnerability that bypasses interceptor rules; users are advised to pin to grpc v1.79.3 while a proper patch is pending.
0000036
50 followersView on X
ThreatCluster@threatcluster123d
Disclosure
openSUSE Leap 16.0 components elemental-system-agent, elemental-register and elemental-toolkit are affected by CVE-2026-33186, an HTTP/2 path pseudo-header authorisation bypass in http://google.golang.org/grpc, Linuxsecurity reported. https://threatcluster.io/cluster/opensuse-leap-160-faces-security-flaw-in-elemental-component-09643b8e
Post summary
A new vulnerability, CVE-2026-33186, affecting openSUSE Leap 16.0 components via an HTTP/2 header bypass in grpc was reported, but no PoC, exploit, or patch is provided.
0000047
318 followersView on X
SteefJan Wiggers (aka Lian’s Husband)@SteefJan132d
Active Exploitation
A trailing slash bypassed AWS HTTP API's Lambda authorizer. Same bypass enabled an unauthenticated wire transfer. Root cause: path normalization mismatch between routing and auth layers. Same bug class hit gRPC-Go via CVE-2026-33186. http://infoq.com/news/2026/06/aws-api-gateway-auth-bypass/ #aws #security #cloud
Post summary
The post reports real‑world exploitation of CVE‑2026‑33186 via a trailing‑slash bypass that enabled unauthenticated wire transfers, citing a path normalization error as the root cause, while providing no PoC code, exploit scripts, or patch information.
0000069
2.7K followersView on X
ThreatCluster@threatcluster177d
Patch
BREAKING: openSUSE Leap 15.6 and Ubuntu Server 22.04 patch critical Terraform provider flaws CVE-2026-25934 and CVE-2026-33186, with HTTP/2 :path bug rated CVSS 9.1 and PoC released 2026-04-07. https://threatcluster.io/cluster/critical-vulnerabilities-in-terraform-providers-affecting-op-588dd59e
Post summary
Patch released for openSUSE Leap 15.6 and Ubuntu Server 22.04 to address critical Terraform provider flaws CVE-2026-25934 and CVE-2026-33186, which involve an HTTP/2 ':path' bug rated CVSS 9.1, and PoC code was released on 2026-04-07.
00000149
155 followersView on X
ThreatCluster@threatcluster186d
PoC
BREAKING: Critical auth bypass CVE-2026-33186 in google-cloud-sap-agent 3.12 hits openSUSE Leap 15.6 and SUSE Linux Enterprise Server, PoC released, CVSS up to 9.1. https://threatcluster.io/cluster/opensuse-google-cloud-sap-agent-authorization-bypass-vulnera-5f0ab979
Post summary
A critical authorization bypass (CVE‑2026‑33186) affecting google‑cloud‑sap‑agent 3.12 has been disclosed, with a PoC released and CVSS score up to 9.1, but no patch or evidence of active exploitation yet.
0000099
133 followersView on X
DailyCVE@dailycve195d
Disclosure
🔴 Traefik, Authorization Bypass, #CVE-2026-33186 (Critical) https://dailycve.com/traefik-authorization-bypass-cve-2026-33186-critical/
Post summary
A critical Traefik authorization bypass vulnerability (CVE‑2026‑33186) has been disclosed, but no PoC, exploitation details, active attacks, or patch information are provided.
0000032
175 followersView on X
WindowsForum@windowsforum199d
Disclosure
🚨 Another day, another “tiny parsing flaw” becomes an auth bypass buffet. Missing leading slash in gRPC-Go means policy checks are trusting the wrong path. Windows users: “canonical or chaos.” #WindowsForum #SecurityCVE https://windowsforum.com/threads/cve-2026-33186-grpc-go-authorization-bypass-from-missing-leading-slash.407501/ #CveRemediation #AuthorizationBypass
Post summary
The post announces a new Windows‑specific CVE (CVE‑2026‑33186) involving a missing leading slash in gRPC‑Go that enables an authorization bypass; it includes a forum link but offers no PoC, exploit code, or patch details.
0000023
1.0K followersView on X
motch | セキュリティ🛡️@motch_dev201d
Disclosure
🚨 gRPC-Goで重大な認可バイパス脆弱性(CVE-2026-33186)が発覚！先頭スラッシュが欠落した不正パスを許容する仕様が原因で、パスベースの認可制御を用いるサーバーがアクセス制限を回避される恐れがあります。自社のシステムでgRPCのバージョンはv1.79.3以降へ安全に更新されていますか? #gRPC #セキュリティニュース
Post summary
The tweet announces a critical authorization-bypass flaw (CVE-2026-33186) in gRPC-Go caused by missing leading slashes in paths; it urges upgrading to version 1.79.3 or later to mitigate.
00000103
252 followersView on X
CVE@CVEnew204d
Patch
CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path… https://www.cve.org/CVERecord?id=CVE-2026-33186
Post summary
CVE‑2026‑33186 targets gRPC‑Go versions below 1.79.3, enabling an authorization bypass due to improper HTTP/2 `:path` validation; upgrading to 1.79.3 or later resolves the issue.
00000153
56.8K followersView on X
CVEFind.com@CveFindCom204d
Patch
[CVE-2026-33186: CRITICAL] gRPC-Go versions before 1.79.3 had an authorization bypass issue due to improper input validation, allowing attackers to exploit raw HTTP/2 frames. Update to version 1.79.3 or use ...#cve,CVE-2026-33186,#cybersecurity https://cvefind.com/CVE-2026-33186
Post summary
gRPC-Go versions prior to 1.79.3 suffer an authorization bypass via improper input validation on HTTP/2 frames. Updating to 1.79.3 mitigates the issue.
0000067
604 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	grpc	grpc	-	go	-

Explore more

Back to dashboard grpc CVEs grpc vulnerabilities

What researchers are saying

CVE-2026-33186

GCP Weekly[verified]@gcpweeklyPatch

The message reports an update to google-guest-agent aimed at remediating CVE-2026-33186 on Debian and Rocky Linux images.

GCP Weekly[verified]@gcpweeklyPatch

Google has upgraded google‑guest‑agent on Debian and Rocky Linux images to apply a fix for CVE‑2026‑33186. The post confirms a vendor patch but lacks exploit details.

ThreatCluster[verified]@threatclusterPatch

SUSE has issued security fixes for CVE-2026-33186 and CVE-2026-33814, addressing an authorization bypass and an HTTP/2 DoS in Public Cloud Module 12. No PoC, exploit code, or evidence of active exploitation is mentioned.

ThreatCluster[verified]@threatclusterDisclosure

A new vulnerability, CVE-2026-33186, affecting openSUSE Leap 16.0 components via an HTTP/2 header bypass in grpc was reported, but no PoC, exploit, or patch is provided.

ThreatCluster[verified]@threatclusterPatch

Patch released for openSUSE Leap 15.6 and Ubuntu Server 22.04 to address critical Terraform provider flaws CVE-2026-25934 and CVE-2026-33186, which involve an HTTP/2 ':path' bug rated CVSS 9.1, and PoC code was released on 2026-04-07.

ThreatCluster[verified]@threatclusterPoC

A critical authorization bypass (CVE‑2026‑33186) affecting google‑cloud‑sap‑agent 3.12 has been disclosed, with a PoC released and CVSS score up to 9.1, but no patch or evidence of active exploitation yet.

WindowsForum[verified]@windowsforumDisclosure

The post announces a new Windows‑specific CVE (CVE‑2026‑33186) involving a missing leading slash in gRPC‑Go that enables an authorization bypass; it includes a forum link but offers no PoC, exploit code, or patch details.

motch | セキュリティ🛡️[verified]@motch_devDisclosure

The tweet announces a critical authorization-bypass flaw (CVE-2026-33186) in gRPC-Go caused by missing leading slashes in paths; it urges upgrading to version 1.79.3 or later to mitigate.