CVE-2026-33186Suited to automated attack · CISA
gRPC-Go has an authorization bypass via missing leading slash in :path
CVSS score
9.1
EPSS probability
%1.6
Risk score
0.1
Published
6 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
gRPC-Go RBAC Authorization Policy Bypass via Missing `:path` Slash (Auth Bypass)
Makefile Go / Python
Similar Vulnerabilities
8.7
CVE-2026-84445
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
G
Patch verifiedEPSS %1
8.7
CVE-2026-84304
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
G
Patch status unknownEPSS %1
6.3
CVE-2026-84303
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
G
Patch verifiedEPSS %0
6.5
CVE-2026-101914
@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
G
Patch status unknownEPSS %0
7.4
CVE-2026-101916
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
G
Patch status unknownEPSS %0
3.7
CVE-2026-101915
@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages
G
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-33186"