CVE-2026-33186
2 advisories.
Go/google.golang.org/grpc CVE-2026-33186: critical 9.1
gRPC-Go has an authorization bypass via missing leading slash in :path
Action: Upgrade google.golang.org/grpc to 1.79.3 or later.
go get google.golang.org/grpc@v1.79.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.79.3 | - |
Fixed versions
| 1.79.3 |
Sources
- osv: GHSA-p77j-4mvh-x3m3
- https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3
- https://nvd.nist.gov/vuln/detail/CVE-2026-33186
- https://github.com/grpc/grpc-go
CVE-2026-33186 · published · modified · JSON
Go/google.golang.org/grpc CVE-2026-33186: unknown
Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
Action: Upgrade google.golang.org/grpc to 1.79.3 or later.
go get google.golang.org/grpc@v1.79.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.79.3 | - |
Fixed versions
| 1.79.3 |
Sources
CVE-2026-33186 · published · modified · JSON