By A missing leading slash in an HTTP/2 path header is all it takes to blow past gRPC-Go’s entire authorization stack. CVE-2026-33186 — rated CVSS 9.1 Critical — lets any attacker with network access to your service skip deny rules silently, no credentials required. If your Go service depends on google.golang.org/grpc below v1.79.3 and uses path-based authorization interceptors, you are exposed right now. The fix is a one-line dependency bump.
What the Bug Actually Is
HTTP/2 requires that the :path pseudo-header begin with a forward slash. RFC 9113 is unambiguous on this. gRPC-Go ignored that rule. It accepted requests where :path read Service/Method instead of /Service/Method — and then routed them correctly to the intended handler.
The problem is what happened next. Authorization interceptors — including the official google.golang.org/grpc/authz RBAC package and any custom interceptors using info.FullMethod or grpc.Method(ctx) — evaluated that raw, non-canonical path string. A deny rule written for /Service/Method never matched Service/Method. If a fallback allow rule was present (it usually is), the request sailed through. Silent. Complete bypass.
Are You Affected?
You need both conditions to be true simultaneously:
- Your service uses path-based auth interceptors: the
grpc/authzpackage, xDS RBAC policies pushed by a service mesh control plane, or custom interceptors that inspect the method path to make allow/deny decisions. - Your authorization policy has explicit deny rules on canonical paths plus a general fallback allow rule for unmatched requests.
Allowlist-only policies — where unmatched requests are denied by default — are not affected. But deny-list-with-fallback is a common pattern in Kubernetes RBAC configurations and Istio authorization policies. Many production services are in this category.
Who Got Hit
A public proof-of-concept has been available since disclosure. Exploitation requires nothing more than raw HTTP/2 frames — a researcher verified a live bypass against grpc-go v1.71.0, obtaining status OK on a deny-listed method simply by omitting the leading slash. No credentials. No prior authentication.
The blast radius is wide. Among the confirmed-affected projects: Kubernetes cluster-autoscaler v1.35.0, Traefik, Envoy Gateway v1.6.6, DataDog Agent, and Istio Service Bridge. Hundreds of automated dependency-bump PRs from Renovate and Dependabot have been filed across public repositories. grpc-go is one of the most widely deployed Go libraries in cloud-native infrastructure — this shared-dependency exposure affects far more projects than are publicly tracked.
Patch: Three Commands
Fixed in grpc-go v1.79.3. The fix is decisive: any :path without a leading slash is now rejected at the transport layer with codes.Unimplemented before reaching interceptors or handlers. Check the GitHub Security Advisory GHSA-p77j-4mvh-x3m3 for full details.
# Check your current version
grep 'google.golang.org/grpc' go.mod
# Upgrade to the patched release
go get google.golang.org/grpc@v1.79.3
go mod tidy
go mod verifyAfter upgrading, confirm the vulnerability is cleared using the Go vulnerability database entry GO-2026-4762:
govulncheck ./...Can’t Patch Right Now?
A compliant HTTP/2 L7 proxy in front of your gRPC service will reject malformed :path headers before they reach your Go code:
- Envoy (as an Istio sidecar or standalone): enforces HTTP/2 pseudo-header conformance per RFC 9113, dropping non-conforming requests at the proxy layer.
- NGINX 1.31.x and later: the stricter HTTP/2 validation pass introduced in 1.31.4 rejects non-standard paths before proxying.
- AWS ALB / GCP Cloud Load Balancing: both validate
:pathat the edge and drop non-conforming HTTP/2 requests.
If your gRPC service is directly internet-exposed or reachable from untrusted internal networks without an L7 proxy, no mitigation exists short of upgrading grpc-go.
Bottom Line
CVE-2026-33186 is one of the nastier CVEs in the Go ecosystem this year. The exploit is trivial, the PoC is public, and the affected dependency is one of the most widely deployed Go libraries in existence. Kubernetes tooling, service meshes, and backend microservices all pull in grpc-go. The patch is available, it is surgical, and it takes three commands. There is no excuse to wait.
