CVE-2026-33186

🗓️ 20 Mar 2026 22:23:32Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 165 Views🌐 WEB

gRPC-Go before 1.79.3 allows auth bypass with non-canonical :path; fix rejects it; mitigations include interceptors or policy hardening.

Reporter	Title	Published	Views	Family All 1163
FreeBSD	traefik -- Multiple vulnerabilities	26 Mar 202600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in google.golang.org/grpc-v1.62.0	28 Apr 202621:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities	27 Apr 202613:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container backup and restore is vulnerable to authorization bypass (CVE-2026-33186)	7 May 202613:37	–	ibm
IBM Security Bulletins	Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale Management GUI, Cluster Export Services (CES) S3 or HDFS layer are now fixed in 5.2.3.8 and 6.0.1.0 or higher	5 Jun 202619:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities addressed with IBM Business Automation Workflow cumulative fixes May 2026	29 May 202616:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Remediator is affected by multiple vulnerabilities	5 May 202615:14	–	ibm
IBM Security Bulletins	Security Bulletin: ELM on Hybrid Cloud vulnerabilities addressed in 2.0.0	20 Apr 202609:57	–	ibm
GithubExploit	Exploit for CVE-2026-33186	6 Apr 202617:33	–	githubexploit
ATTACKERKB	CVE-2026-33186	20 Mar 202622:23	–	attackerkb

NVD

Vulners

Node

grpc grpcRange<1.79.3go

[
  {
    "vendor": "grpc",
    "product": "grpc-go",
    "versions": [
      {
        "version": "< 1.79.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3

Parameter	Position	Path	Description	CWE
path	path	/Service/Method	RBAC authorization bypass in gRPC-Go when :path is missing a leading slash (non-canonical path) causing deny rules to miss and allow rule to apply. The vulnerability arises in authz with path-based policies and can be exploited by sending non-canonical :path (e.g., "Service/Method") via HTTP/2 frames.	CWE-285

10 Apr 2026 20:49Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.1

EPSS0.0002

SSVC

CWE-285