Loading vulnerability…
CVE-2026-33186 is an authorization bypass vulnerability in gRPC-Go affecting versions prior to 1.79.3. The flaw is caused by improper input validation of the HTTP/2 :path pseudo-header in the server request handling path. gRPC-Go accepted non-canonical method paths that omitted the mandatory leading slash and still routed them to the intended RPC handler. However, authorization interceptors, including the official google.golang.org/grpc/authz RBAC implementation and custom interceptors using info.FullMethod or grpc.Method(ctx), evaluated the raw non-canonical path string rather than a normalized canonical form. As a result, deny rules written for canonical gRPC method paths failed to match malformed requests, enabling policy bypass when broader allow behavior remained in place. Version 1.79.3 corrects this by rejecting requests whose :path does not begin with a leading slash before they reach authorization logic or handlers.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
:path values before they reach the gRPC service. Policy hardening can further reduce exposure by avoiding permissive fallback allow rules for unmatched paths and instead defaulting to deny.Patch, then assume compromise.
:path pseudo-header and rejects requests that do not start with a leading slash with a codes.Unimplemented response, preventing malformed paths from reaching authorization interceptors or service handlers. Products that vendor or bundle gRPC-Go should be updated to releases incorporating the fixed library version.1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small proof-of-concept exploit for CVE-2026-33186, an authorization bypass in grpc-go's authz RBAC handling. The repo contains 3 files: LICENSE, README.md, and a single executable code file, poc.py. The README documents the vulnerability, affected versions, expected behavior, and usage examples. Although the README references additional files such as a demo server, Docker assets, and protobuf definitions, they are not present in the analyzed repository snapshot. The core exploit logic is in poc.py, a standalone Python script using the h2 library to manually speak HTTP/2 over a raw TCP socket and construct gRPC requests. Its main capability is to send crafted gRPC calls where the HTTP/2 :path pseudo-header is attacker-controlled. The exploit demonstrates that a deny rule written against the canonical path form (/Service/Method) can be bypassed by sending the same path without the leading slash (Service/Method). According to the included documentation and code flow, the script performs three requests: (1) a baseline request to a protected admin method with a normal slash-prefixed path, expected to return gRPC status 7 PermissionDenied; (2) an attack request to the same method with the leading slash removed, expected to return gRPC status 0 OK on vulnerable servers; and (3) a control request to a public method, expected to succeed. Technically, the script includes helper routines to encode and decode gRPC frames and minimal protobuf string messages, then opens a socket to the specified host and port, initializes an HTTP/2 connection, sends gRPC headers and body, and parses response trailers for grpc-status and grpc-message. The exploit is network-based and targets reachable gRPC services over cleartext HTTP/2 as implemented by the PoC. It is a real exploit rather than a fake sample, but its maturity is best classified as POC because it is narrowly focused on vulnerability verification rather than generalized post-exploitation. The practical result of successful exploitation is unauthorized invocation of a deny-listed RPC method on vulnerable grpc-go servers.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
68 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An authorization bypass vulnerability in gRPC-Go's authz component caused by improper HTTP/2 path validation.
An authorization bypass vulnerability in gRPC-Go caused by improper HTTP/2 path validation.
An authorization bypass vulnerability in gRPC-Go caused by improper HTTP/2 path validation.
An authorization bypass vulnerability in gRPC-Go caused by improper HTTP/2 path validation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.