CVE-2026-33186: gRPC-Go Auth Bypass Lets Attackers Skip Deny Rules With a Missing Slash

Fri, 03 Apr 2026 22:37:28 -0400

A subtle path normalization flaw in gRPC-Go — tracked as CVE-2026-33186 — lets remote, unauthenticated attackers completely bypass authorization rules on any Go service that uses path-based access control. The bug rates CVSS 9.1. If your Go microservices speak gRPC and you use the official grpc/authz package or custom interceptors based on info.FullMethod, you need to patch now.

What Happened

On March 20, 2026, the gRPC-Go team disclosed a critical authorization bypass (GHSA-p77j-4mvh-x3m3) affecting all versions of google.golang.org/grpc before v1.79.3.

Microservices on cybercrime.club

CVE-2026-33186: gRPC-Go Auth Bypass Lets Attackers Skip Deny Rules With a Missing Slash

What Happened