CVE-2026-33186: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-33186 is a critical authorization bypass vulnerability in gRPC-Go (the Go language implementation of gRPC) caused by improper input validation of the HTTP/2 :path pseudo-header. All versions of google.golang.org/grpc prior to 1.79.3 are affected. The vulnerability was disclosed on March 17, 2026, via a GitHub Security Advisory, and published to the NVD on March 20, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) (Github Advisory, grpc-go Advisory).

The root cause is classified under CWE-285 (Improper Authorization) and CWE-551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization). The gRPC-Go server accepted HTTP/2 requests where the :path pseudo-header omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server correctly routed these requests to the appropriate handler, authorization interceptors — including the official google.golang.org/grpc/authz RBAC package and custom interceptors using info.FullMethod or grpc.Method(ctx) — evaluated the raw, non-canonical path string. As a result, "deny" rules defined for canonical paths (starting with /) failed to match, allowing the request to bypass the policy when a fallback "allow" rule was present. Exploitation requires the ability to send raw HTTP/2 frames with a malformed :path header directly to the gRPC server (Github Advisory, grpc-go Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass path-based authorization policies and gain unauthorized access to protected gRPC methods and services. The vulnerability results in high confidentiality and integrity impact — an attacker can read sensitive data and perform unauthorized operations on the gRPC server — though availability is not directly affected. Downstream products embedding gRPC-Go are also at risk, including IBM QRadar AQL Plugin, IBM Db2 on Cloud Pak for Data, IBM watsonx Orchestrate, IBM Business Automation Workflow, IBM Storage Scale, Splunk AppDynamics Cluster Agent, and various Red Hat and SUSE products (Github Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The vulnerability is exploitable by any unauthenticated network attacker who can send raw HTTP/2 frames to the gRPC server, requiring no privileges or user interaction. The EPSS score is approximately 0.013% (0.000130), indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection signatures are available in Nessus and Qualys scanners (Github Advisory).

1. Reconnaissance: Identify gRPC-Go servers running versions prior to 1.79.3 that use path-based authorization interceptors (e.g., google.golang.org/grpc/authz) with a "deny-specific, allow-default" policy structure. Tools like Shodan or Censys can help locate exposed gRPC endpoints.
2. Craft malformed HTTP/2 request: Using an HTTP/2-capable client or raw frame crafting tool (e.g., h2c, curl --http2, or a custom Go client), construct a HEADERS frame where the :path pseudo-header omits the leading slash — for example, set :path to MyService/MyMethod instead of /MyService/MyMethod.
3. Send request to gRPC server: Transmit the crafted HTTP/2 frame directly to the target gRPC server port (typically 443 or 50051). The server's lenient routing logic accepts and routes the request to the correct handler.
4. Bypass authorization: The authorization interceptor evaluates the raw non-canonical path string (MyService/MyMethod), which does not match the "deny" rule defined for /MyService/MyMethod, causing the deny rule to be skipped. The fallback "allow" rule then permits the request.
5. Access protected resource: The request reaches the protected gRPC handler and executes, granting the attacker unauthorized access to the service method, potentially exposing sensitive data or allowing unauthorized operations (grpc-go Advisory, Github Advisory).

• Network: Inbound HTTP/2 HEADERS frames to the gRPC server port where the :path pseudo-header does not begin with a / (e.g., Service/Method rather than /Service/Method); unexpected gRPC calls to sensitive or restricted service methods from unauthenticated or low-privilege sources.
• Logs: gRPC server access logs showing requests with non-canonical method paths (missing leading slash) that were successfully routed; absence of authorization denial log entries for requests that should have been blocked by deny rules.
• Application Behavior: Successful invocations of gRPC methods that should be denied per the configured RBAC or authz policy, particularly from clients that do not hold the expected credentials or roles.

Primary fix: Upgrade google.golang.org/grpc to version 1.79.3 or later. The fix immediately rejects any request whose :path does not start with a leading slash with a codes.Unimplemented error, before it reaches any authorization interceptor (Github Advisory).

Workarounds (if immediate upgrade is not possible):

1. Validating interceptor (recommended): Add a path-validation interceptor as the outermost interceptor in the server chain that rejects requests where info.FullMethod does not start with /.
2. Infrastructure-level normalization: Configure a reverse proxy or load balancer (e.g., Envoy, NGINX) in front of the gRPC server to enforce strict HTTP/2 :path compliance and reject or normalize non-canonical paths.
3. Policy hardening: Switch authorization policies to a "default deny" posture — explicitly allow only known canonical paths and deny everything else — to eliminate the fallback allow rule that enables the bypass (grpc-go Advisory).

Vendor patches have also been issued by Red Hat (RHEL 8/9/10, OpenShift), SUSE/openSUSE, IBM (multiple products), Splunk AppDynamics, and Amazon Linux (Red Hat Bugzilla).

The vulnerability received notable community attention shortly after disclosure, with discussion on Reddit's r/golang community and posts on Bluesky and Mastodon highlighting the authorization bypass risk (Github Advisory). Security news outlets including The Hacker Wire and SecurityOnline.info covered the flaw, emphasizing the "missing slash" root cause and its potential impact on gRPC-based microservices. The Kubernetes and cloud-native ecosystem responded quickly, with projects such as Traefik, Portainer, HashiCorp Consul, oauth2-proxy, and external-secrets releasing updated versions that incorporate the patched gRPC-Go dependency. The Last Week in Kubernetes newsletter also highlighted the vulnerability as a notable security event for the cloud-native community.