Improper Authorization in grpc-go - CVE-2026-33186

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU128730

Improper Authorization in grpc-go - CVE-2026-33186

Published: May 1, 2026


Vulnerability identifier: #VU128730
CSH Severity: High
CVSS v4 BT: 8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2026-33186
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to bypass authorization.

The vulnerability exists due to authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server to bypass authorization.


Affected software

grpc-go
Red Hat OpenShift Container Platform
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Client Tools for SLE Micro
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Micro
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Public Cloud Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
HPC Module
SUSE Package Hub 15
Basesystem Module
openSUSE Leap
openEuler
Support for Hyperledger Fabric
Fusion Content-Aware Storage
Traefik
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Fusion HCI
App Connect Enterprise Certified Container
Red Hat OpenStack
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
rhc (Red Hat package)
elemental-system-agent
opentelemetry-collector (Red Hat package)
runc (Red Hat package)
containernetworking-plugins (Red Hat package)
elemental-register
elemental-support
golang-github-prometheus-node_exporter
golang-github-prometheus-node_exporter-debuginfo
kata-containers-go
skopeo (Red Hat package)
terraform-provider-local
ignition
ignition-dracut-grub2
ignition-debuginfo
terraform-provider-tls
terraform-provider-random
terraform-provider-null
kata-containers
etcd (Red Hat package)
golang-github-prometheus-prometheus-debuginfo
golang-github-prometheus-prometheus
google-cloud-sap-agent
release-notes-susemanager-proxy
release-notes-susemanager
ose-azure-acr-image-credential-provider (Red Hat package)
microshift (Red Hat package)
kernel (Red Hat package)
azure-storage-azcopy
image-builder (Red Hat package)
osbuild-composer (Red Hat package)
google-osconfig-agent
google-guest-agent
OpenShift Data Foundation (formerly OpenShift Container Storage)
Red Hat build of MicroShift

How to mitigate CVE-2026-33186

Install updates from vendor's website.

grpc-go - update to 1.79.3
Traefik - addressed in versions 2.11.42, 3.6.12
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
rhc (Red Hat package) - addressed in versions 0.2.5-6.el8_10, 0.2.7-1.el9_6.3, 0.2.7-4.el9_7
elemental-system-agent - update to 0.3.16-160000.1.1
opentelemetry-collector (Red Hat package) - addressed in versions 0.144.0-2.el9_4, 0.144.0-2.el9_6, 0.144.0-2.el10_0
Fusion Content-Aware Storage - update to 1.1.4
runc (Red Hat package) - update to 1.2.9-4.rhaos4.16.el8
containernetworking-plugins (Red Hat package) - update to 1.4.0-9.rhaos4.16.el8
elemental-register - update to 1.9.2-160000.1.1
elemental-support - update to 1.9.2-160000.1.1
golang-github-prometheus-node_exporter - update to 1.10.2-150100.3.42.1
golang-github-prometheus-node_exporter-debuginfo - update to 1.10.2-150100.3.42.1
kata-containers-go - update to 1.11.1-32
skopeo (Red Hat package) - update to 1.14.5-7.rhaos4.16.el8
terraform-provider-local - update to 2.0.0-150200.6.8.1
IBM Fusion HCI - update to 2.12.2
ignition - addressed in versions 2.14.0-150300.6.19.1, 2.14.0-150400.4.15.1, 2.14.0-150400.9.15.1, 2.15.0-150400.4.14.1, 2.17.0-150500.3.15.1
ignition-dracut-grub2 - addressed in versions 2.14.0-150300.6.19.1, 2.14.0-150400.4.15.1, 2.14.0-150400.9.15.1, 2.15.0-150400.4.14.1, 2.17.0-150500.3.15.1
ignition-debuginfo - addressed in versions 2.14.0-150300.6.19.1, 2.14.0-150400.4.15.1, 2.14.0-150400.9.15.1, 2.15.0-150400.4.14.1, 2.17.0-150500.3.15.1
terraform-provider-tls - update to 3.0.0-150200.5.6.2
terraform-provider-random - update to 3.0.0-150200.6.6.2
terraform-provider-null - update to 3.0.0-150200.6.12.1
kata-containers - update to 3.2.0-17
etcd (Red Hat package) - update to 3.4.26-9.5.el9ost
golang-github-prometheus-prometheus-debuginfo - update to 3.5.3-150100.4.34.1
golang-github-prometheus-prometheus - update to 3.5.3-150100.4.34.1
google-cloud-sap-agent - addressed in versions 3.12-6.60.1, 3.12-150100.3.63.1
release-notes-susemanager-proxy - update to 4.3.18-150400.3.110.2
release-notes-susemanager - update to 4.3.18-150400.3.154.2
Red Hat OpenShift Container Platform - addressed in versions 4.12.93, 4.12.94, 4.14.67, 4.14.69, 4.15.65, 4.16.65, 4.16.66, 4.17.55, 4.18.44, 4.18.45, 4.18.48, 4.18.50, 4.19.33, 4.19.34, 4.19.35, 4.19.40, 4.20.25, 4.20.30, 4.21.20, 4.21.23, 4.21.25, 4.22.4
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202606221818.p2.ga3ebdc0.assembly.stream.el8, 4.16.0-202606221818.p2.ga3ebdc0.assembly.stream.el9, 4.18.0-202606160919.p2.g9795abd.assembly.stream.el8, 4.18.0-202606160919.p2.g9795abd.assembly.stream.el9, 4.19.0-202606111920.p2.g6282230.assembly.stream.el9
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.16.30, 4.18.24, 4.18.25, 4.19.19, 4.19.20, 4.20.14
Red Hat build of MicroShift - addressed in versions 4.16.63, 4.18.42, 4.19.32
microshift (Red Hat package) - addressed in versions 4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9, 4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9, 4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
kernel (Red Hat package) - addressed in versions 5.14.0-427.132.1.el9_4, 5.14.0-570.122.1.el9_6
azure-storage-azcopy - update to 10.29.1-150400.9.6.1
App Connect Enterprise Certified Container - addressed in versions 12.0.23, 13.1.0
Red Hat OpenStack - update to 17.1
image-builder (Red Hat package) - update to 52.1-1.el10_2
osbuild-composer (Red Hat package) - addressed in versions 101.5-1.el8_10, 132.2-9.el9_6, 134.1-9.el10_0
google-osconfig-agent - update to 20250416.02-1.44.1
google-guest-agent - update to 20250506.01-1.56.1

External References

Related Security Bulletins