gRPC-Go is the Go language implementation of gRPC.

CVE-2026-33186 is an authorization bypass in google.golang.org/grpc versions prior to v1.79.3. The gRPC-Go HTTP/2 server transport stored the raw :path pseudo-header value without validating its leading slash. The routing layer internally normalized paths for dispatch, but authorization interceptors — including the official grpc/authz RBAC engine (authz.NewStatic(), authz.NewFileWatcher()) and any custom interceptor reading info.FullMethod or grpc.Method(ctx) — evaluated the *raw, pre-normalization* string. An attacker sending Service/Method instead of /Service/Method caused deny rules to fail string matching, falling through to a permissive default-allow policy. The result: complete bypass of path-based RBAC deny rules with a single missing character.

The vendor CVSS of 9.1 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) models a universally exploitable, unauthenticated network attack — and the attack *is* trivially easy when the preconditions are met. But the score overstates real-world exposure because it ignores two compounding friction points: (1) the vulnerability only fires when the target uses gRPC-Go's built-in authz interceptor with a deny-rule + fallback-allow policy pattern, which is a fraction of deployments, and (2) the vast majority of gRPC services sit behind internal service meshes or API gateways, not on the public internet. The 9.1 is the theoretical ceiling; most environments sit well below it.

Why this verdict

• Narrow trigger condition: The bypass requires the target to use grpc/authz (or a custom interceptor reading raw FullMethod) with a deny-rule + fallback-allow policy. Deployments using allow-list-only policies, external authorization (OPA, Istio, service mesh), or mTLS-only auth are unaffected. This meaningfully reduces the reachable population below the universal scope the 9.1 CVSS assumes.
• Internal-only exposure: The overwhelming majority of gRPC-Go services run behind service meshes, internal load balancers, or API gateways — not directly internet-facing. Exploiting from outside requires a prior foothold or a misconfigured edge, adding an implicit prerequisite the CVSS doesn't capture.
• Trivial exploitation when conditions met: The attack is a single malformed HTTP/2 header with a public PoC. No memory corruption, no race conditions, no brute force. When the authz pattern is present, exploitation is deterministic and reliable — this prevents further downgrade.
• Role multiplier: gRPC-Go is embedded in high-value infrastructure — Kubernetes control plane components (etcd client libraries), service mesh control planes (Istio Pilot), ingress controllers (Traefik), and monitoring agents (Datadog). However, most of these high-value consumers use mTLS or external policy engines for authorization rather than the built-in grpc/authz package. Traefik is a confirmed affected downstream in a network-edge role, keeping the floor at HIGH. If an organization's Traefik deployment relied on gRPC authz deny rules, the blast radius would be network-edge bypass → HIGH floor holds.
• Public PoC availability: The JohannesLks PoC has been public since ~June 2026, lowering the attacker skill bar and increasing the urgency to patch even without observed exploitation.

Why not higher?

The vulnerability does not universally affect all gRPC-Go deployments — only those using the specific authz interceptor with deny-list policies. The canonical high-value consumers of gRPC-Go (etcd, Kubernetes API server, Istio) predominantly use mTLS and external policy engines, not the built-in authz package. Without evidence of active exploitation or KEV listing, and with the narrow trigger condition, CRITICAL is not warranted.

Why not lower?

The attack is unauthenticated, network-reachable, trivially exploitable with a public PoC, and results in complete authorization bypass (C:H/I:H). Traefik — a network-edge component — is a confirmed affected downstream, establishing a HIGH floor via the role-multiplier rule. The EPSS of 1.6% is non-trivial, and the Go ecosystem's broad adoption means the absolute number of vulnerable instances is significant even if the percentage is modest.

1. Upgrade gRPC-Go to v1.79.3 immediately — The fix rejects any request with a :path missing the leading slash at the transport layer, before it reaches interceptors. This is the definitive fix. For a HIGH verdict, deploy within 30 days per noisgate mitigation SLA.
2. Deploy reverse proxy path validation — Configure your L7 proxy (Envoy, nginx, HAProxy) to reject HTTP/2 requests where :path does not start with /. Envoy's normalize_path and merge_slashes options help. This blocks the attack before it reaches gRPC-Go.
3. Switch to allow-list-only RBAC policies — If using grpc/authz, restructure policies to explicit allow-list (default deny) rather than deny-list + fallback allow. The bypass only works when deny rules fail to match and a fallback allow permits the request.
4. Audit downstream Go module dependencies — Run go list -m all | grep google.golang.org/grpc across all Go services to identify which binaries embed a vulnerable gRPC-Go version. Prioritize services using grpc/authz imports.
5. Update affected downstream packages — Patch Traefik to 2.11.42+ / 3.6.12+, Datadog Agent per vendor guidance, IBM Fusion per IBM Security Bulletin. These bundle vulnerable gRPC-Go.

Run this on each host or in CI where Go services are built. It scans go.sum files to detect vulnerable gRPC-Go versions. No special privileges needed. Example: bash check_cve_2026_33186.sh /path/to/your/go/project

#!/usr/bin/env bash
# CVE-2026-33186 checker: detects vulnerable google.golang.org/grpc versions
# Usage: bash check_cve_2026_33186.sh <path-to-go-module-root>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

TARGET_DIR="${1:-.}"
FIXED_VERSION="1.79.3"

if [ ! -f "$TARGET_DIR/go.sum" ] && [ ! -f "$TARGET_DIR/go.mod" ]; then
  echo "UNKNOWN: No go.sum or go.mod found in $TARGET_DIR"
  exit 2
fi

# Try go.sum first, fall back to go.mod
GRPC_VERSION=""
if [ -f "$TARGET_DIR/go.sum" ]; then
  GRPC_VERSION=$(grep -oP 'google\.golang\.org/grpc v\K[0-9]+\.[0-9]+\.[0-9]+' "$TARGET_DIR/go.sum" | sort -V | tail -1)
fi
if [ -z "$GRPC_VERSION" ] && [ -f "$TARGET_DIR/go.mod" ]; then
  GRPC_VERSION=$(grep -oP 'google\.golang\.org/grpc v\K[0-9]+\.[0-9]+\.[0-9]+' "$TARGET_DIR/go.mod" | head -1)
fi

if [ -z "$GRPC_VERSION" ]; then
  echo "UNKNOWN: google.golang.org/grpc not found in module files"
  exit 2
fi

echo "Detected gRPC-Go version: v$GRPC_VERSION"
echo "Fixed version: v$FIXED_VERSION"

# Compare versions using sort -V
LOWEST=$(printf '%s\n%s' "$GRPC_VERSION" "$FIXED_VERSION" | sort -V | head -1)

if [ "$GRPC_VERSION" = "$FIXED_VERSION" ] || [ "$LOWEST" = "$FIXED_VERSION" ]; then
  echo "PATCHED: gRPC-Go v$GRPC_VERSION >= v$FIXED_VERSION"
  exit 0
else
  echo "VULNERABLE: gRPC-Go v$GRPC_VERSION < v$FIXED_VERSION (CVE-2026-33186)"
  # Additional check: see if grpc/authz is imported
  if grep -rq 'google.golang.org/grpc/authz' "$TARGET_DIR/" 2>/dev/null; then
    echo "WARNING: This project imports grpc/authz — HIGH exploitation risk"
  else
    echo "NOTE: grpc/authz import not detected — lower exploitation risk (but custom interceptors may still be affected)"
  fi
  exit 1
fi

Sources

1. GitHub Advisory GHSA-p77j-4mvh-x3m3
2. NVD CVE-2026-33186 Detail
3. JohannesLks PoC — gRPC-Go RBAC Bypass
4. Traefik Security Advisory GHSA-46wh-3698-f2cx
5. Datadog Agent Issue #48151
6. IBM Fusion Security Bulletin
7. Red Hat CVE Page
8. Go Vulnerability Database GO-2026-4762