CVE-2026-33186

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc

### Impact _What kind of vulnerability is it? Who is impacted?_ It is an **Authorization Bypass** resulting from **Improper Input Validation** of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. **Who is impacted?** This affects gRPC-Go servers that meet both of the following criteria: 1. They use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`. 2. Their security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Yes, the issue has been patched. The fix ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. Users should upgrade to the following versions (or newer): * **v1.79.3** * The latest **master** branch. It is recommended that all users employing path-based authorization (especially `grpc/authz`) upgrade as soon as the patch is available in a tagged release. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: #### 1. Use a Validating Interceptor (Recommended Mitigation) Add an "outermost" interceptor to your server that validates the path before any other authorization logic runs: ```go func pathValidationInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) { if info.FullMethod == "" || info.FullMethod[0] != '/' { return nil, status.Errorf(codes.Unimplemented, "malformed method name") } return handler(ctx, req) } // Ensure this is the FIRST interceptor in your chain s := grpc.NewServer( grpc.ChainUnaryInterceptor(pathValidationInterceptor, authzInterceptor), ) ``` #### 2. Infrastructure-Level Normalization If your gRPC server is behind a reverse proxy or load balancer (such as Envoy, NGINX, or an L7 Cloud Load Balancer), ensure it is configured to enforce strict HTTP/2 compliance for pseudo-headers and reject or normalize requests where the `:path` header does not start with a leading slash. #### 3. Policy Hardening Switch to a "default deny" posture in your authorization policies (explicitly listing all allowed paths and denying everything else) to reduce the risk of bypasses via malformed inputs.

gRPC-Go es la implementación en lenguaje Go de gRPC. Las versiones anteriores a la 1.79.3 tienen un bypass de autorización resultante de una validación de entrada incorrecta del pseudo-encabezado HTTP/2 ':path'. El servidor gRPC-Go era demasiado indulgente en su lógica de enrutamiento, aceptando solicitudes donde el ':path' omitía la barra inicial obligatoria (por ejemplo, 'Service/Method' en lugar de '/Service/Method'). Si bien el servidor enrutó con éxito estas solicitudes al gestor correcto, los interceptores de autorización (incluido el paquete oficial 'grpc/authz') evaluaron la cadena de ruta cruda y no canónica. En consecuencia, las reglas de 'denegación' definidas usando rutas canónicas (que comienzan con '/') no lograron coincidir con la solicitud entrante, permitiendo que bypassara la política si una regla de 'permiso' de respaldo estaba presente. Esto afecta a los servidores gRPC-Go que utilizan interceptores de autorización basados en rutas, como la implementación oficial de RBAC en 'google.golang.org/grpc/authz' o interceptores personalizados que dependen de 'info.FullMethod' o 'grpc.Method(ctx)'; Y que tienen una política de seguridad que contiene reglas de 'denegación' específicas para rutas canónicas pero permite otras solicitudes por defecto (una regla de 'permiso' de respaldo). La vulnerabilidad es explotable por un atacante que puede enviar tramas HTTP/2 crudas con encabezados ':path' malformados directamente al servidor gRPC. La corrección en la versión 1.79.3 asegura que cualquier solicitud con un ':path' que no comience con una barra inicial sea inmediatamente rechazada con un error 'codes.Unimplemented', impidiendo que llegue a los interceptores de autorización o gestores con una cadena de ruta no canónica. Si bien la actualización es la ruta más segura y recomendada, los usuarios pueden mitigar la vulnerabilidad utilizando uno de los siguientes métodos: Usar un interceptor de validación (mitigación recomendada); normalización a nivel de infraestructura; y/o endurecimiento de políticas.