GO-2026-4762

Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc

En bref

Publiée: 2026-03-27 18:39 UTC
Mise à jour: 2026-03-30 17:59 UTC
CVE: CVE-2026-33186
Alias: GHSA-p77j-4mvh-x3m3

Description

Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc

Paquets affectés

Paquet	Versions
Go · google.golang.org/grpc	introduced 0, fixed 1.79.3

Références

https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3 ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database