CVE-2026-33186 — gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3…

/HIGH
CVE Notify vulnerabilitycve
CVE-2026-33186 — gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3…

🚨 CVE-2026-33186 gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted t

Authorization bypass via missing leading slash in :path
github.com

What This Means For You

  • Affects Google ecosystem — review Chrome/Android/GCP deployments.
  • New vulnerability disclosed — verify if your stack is exposed.
  • Supply chain risk — audit dependencies and third-party integrations.

Related ATT&CK Techniques

T1190 Exploit Public-Facing Application Initial Access T1071.004 Web Protocols Initial Access

Indicators of Compromise

IDTypeIndicator
CVE-2026-33186 Vulnerability CVE-2026-33186
🔎
Get the full picture on this threat Use /org to search affected organizations, generate IOC briefs with /brief, and set watchlist alerts — inside Telegram.
Try Intel Bot →
Source & Attribution
Source PlatformTelegram
ChannelCVE Notify
Channel ID1129491012
Message ID158858
PublishedApril 10, 2026 at 23:56 UTC
Original Linkhttps://github.com/grpc/grpc-go/security/advisories/GHSA-...

This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.

Believe this infringes your rights? Submit a takedown request.