Go/google.golang.org/grpc CVE-2026-33186: critical 9.1, EPSS 1.58%
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
Action: Upgrade google.golang.org/grpc to 1.79.3 or later.
go get google.golang.org/grpc@v1.79.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.79.3 | - |
Fixed versions
| 1.79.3 |
Sources
- osv: GO-2026-4762
- nvd: CVE-2026-33186
- https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3
CVE-2026-33186 · published · modified · JSON