CVE-2026-33186: Authorization bypass in gRPC-Go

CVE-2026-33186 affects gRPC-Go versions prior to 1.79.3 with an authorization bypass from insufficient validation of the HTTP/2 :path pseudo-header. The server accepts requests where :path omits the mandatory leading slash (e.g. 'Service/Method' instead of '/Service/Method'), bypassing path-based authorization policies. This impacts gRPC-Go servers using path-based authorization interceptors, including the official google.golang.org/grpc/authz package.

The vulnerability has a CVSS score of 9.1 and is classified as critical. The attack requires an attacker capable of sending raw HTTP/2 frames with malformed :path headers directly to the gRPC server. While active exploitation in the wild is not confirmed, a GitHub signal from today (2026-11-02) documents repositories claiming to contain lab-verified exploit code, indicating public availability of proof-of-concept material.

The primary action is to update gRPC-Go to version 1.79.3 or later, where requests with :path lacking a leading slash are immediately rejected with codes.Unimplemented, preventing them from reaching authorization interceptors. Until patching, implement mitigations: a validating interceptor (recommended), infrastructure-level :path normalization, and/or hardening of authorization policies to avoid overly permissive default 'allow' rules. Identify applications in your environment depending on gRPC-Go with path-based authorization.