GO-2026-4762

Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc

At a glance

Published: 2026-03-27 18:39 UTC
Updated: 2026-03-30 17:59 UTC
CVE: CVE-2026-33186
Aliases: GHSA-p77j-4mvh-x3m3

Description

Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc

Affected packages

Package	Versions
Go · google.golang.org/grpc	introduced 0, fixed 1.79.3

References

https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3 ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database