CVE-2026-33186

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.

This vulnerability is rated as an Important severity impact for Red Hat because remote unauthenticated attackers could bypass access restrictions, potentially compromising service integrity and exposing sensitive internal data across affected endpoints. To successfully exploit this issue, services must implement path-based authorization interceptors that enforce specific deny rules while permitting other requests through a fallback allow configuration. Typical Red Hat product deployments configure components with strict default-deny policies or transport-level mutual TLS, restricting the practical attack surface to non-standard environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 :path headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the :path header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.