google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🗓️ 16 Jul 2026 14:35:59Reported by RedHatType

redhat🔗 access.redhat.com👁 27 Views

Go gRPC Go allows authorization bypass via malformed http two frames path omitting the leading slash.

Reporter	Title	Published	Views	Family All 1000
FreeBSD	traefik -- Multiple vulnerabilities	26 Mar 202600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization	27 Aug 202619:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.	22 Sep 202607:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in google.golang.org/grpc-v1.62.0	28 Apr 202621:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities	27 Apr 202613:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Authorization Bypass.	1 Sep 202614:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Support for Hyperledger Fabric is vulnerable to CVE-2026-33186	25 Jun 202618:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container backup and restore is vulnerable to authorization bypass (CVE-2026-33186)	7 May 202613:37	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software	7 Sep 202622:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization	31 Jul 202622:38	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9	aarch64	flightctl-agent	1.1.3-1.el9em	flightctl-agent-1.1.3-1.el9em.aarch64.rpm
Red Hat Enterprise Linux	9	ppc64le	flightctl-agent	1.1.3-1.el9em	flightctl-agent-1.1.3-1.el9em.ppc64le.rpm
Red Hat Enterprise Linux	9	s390x	flightctl-agent	1.1.3-1.el9em	flightctl-agent-1.1.3-1.el9em.s390x.rpm
Red Hat Enterprise Linux	9	x86_64	flightctl-agent	1.1.3-1.el9em	flightctl-agent-1.1.3-1.el9em.x86_64.rpm
Red Hat Enterprise Linux	10	aarch64	flightctl-agent	1.1.3-1.el10em	flightctl-agent-1.1.3-1.el10em.aarch64.rpm
Red Hat Enterprise Linux	10	ppc64le	flightctl-agent	1.1.3-1.el10em	flightctl-agent-1.1.3-1.el10em.ppc64le.rpm
Red Hat Enterprise Linux	10	s390x	flightctl-agent	1.1.3-1.el10em	flightctl-agent-1.1.3-1.el10em.s390x.rpm
Red Hat Enterprise Linux	10	x86_64	flightctl-agent	1.1.3-1.el10em	flightctl-agent-1.1.3-1.el10em.x86_64.rpm
Red Hat Enterprise Linux	9	aarch64	flightctl-cli	1.1.3-1.el9em	flightctl-cli-1.1.3-1.el9em.aarch64.rpm
Red Hat Enterprise Linux	9	ppc64le	flightctl-cli	1.1.3-1.el9em	flightctl-cli-1.1.3-1.el9em.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-33186
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33186
cve	www.cve.org/CVERecord

02 Oct 2026 22:15Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.19.1

EPSS0.01625

SSVC

authorization bypass malformed http two frames path validation flaw leading slash missing security policy bypass remote attacker