VDB
RHSA-2026:53773
RHSA-2026:53773
PUBLISHED
CVSS 9.100000381469727 CRITICAL
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-operator-rhel9@sha256:27115a677a2ec51a9deaf1bb2eb82e28d01a22adf9ecd848f2d8ac24428cd3eb_amd64 as a component of Red Hat Container Native Virtualization 4.19 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-server-rhel9@sha256:c0f08cb14f325a0c771c854fce3b30cb8ce94a7e64cb0fb82fab0ea7eb50988f_s390x as a component of Red Hat Container Native Virtualization 4.19 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-controller-rhel9@sha256:fcdfeb04a046d3c710ae74730121dd3ad34305bb4ec8d0cca64d960d8843084d_s390x as a component of Red Hat Container Native Virtualization 4.19 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-controller-rhel9@sha256:484643af88d45773372fab81ed3b46d1bc12b754ca2044b84dfbd21bbf16ab1f_amd64 as a component of Red Hat Container Native Virtualization 4.19 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-operator-rhel9@sha256:b8d9020e840fbf32c9c12e9fa38778d8bfdb5f9f8b849112758f0d2cf08df00f_arm64 as a component of Red Hat Container Native Virtualization 4.19 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-server-rhel9@sha256:e07a0ec5489c0b9c7f13dc5b3edb572369d0761cda9f673c30cadd2bf4e1cac9_amd64 as a component of Red Hat Container Native Virtualization 4.19 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-operator-rhel9@sha256:b472c07b81fb19ded65c8b3e7ff55ce02a16277d3e1ffd09fb3c53acd358bf97_s390x as a component of Red Hat Container Native Virtualization 4.19 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-server-rhel9@sha256:a9bb34648ec6323171a58328e12532dc67ed341fe19620ccae63c208a8ff8f9b_arm64 as a component of Red Hat Container Native Virtualization 4.19 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-controller-rhel9@sha256:4a72cbf3828e5bae55b71753191c09216359a6ebcfbb7dddbdbb9e147d9817d6_arm64 as a component of Red Hat Container Native Virtualization 4.19 | * |
Timeline
- Aug 11, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:53773 advisory
- https://access.redhat.com/security/cve/CVE-2026-33186 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53773.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2449833 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33186 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33186 advisory
- https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3 advisory