VDB
RHSA-2026:53804
RHSA-2026:53804
PUBLISHED
CVSS 9.100000381469727 CRITICAL
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-controller-rhel9@sha256:4988e8a7db4524568c2ac31569dd6fba455e62f5eca2eb0ec341ec04f12bab1f_amd64 as a component of Red Hat Container Native Virtualization 4.16 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-operator-rhel9@sha256:af33ad17e71131ee027b29106410ef6b77e5c5bb9be9ffab84b184f7d323c7b8_arm64 as a component of Red Hat Container Native Virtualization 4.16 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-server-rhel9@sha256:554f1b28e2aa74a3001687dd8b5b9fd36b5bac5be20176cecf151d8e009b7d26_arm64 as a component of Red Hat Container Native Virtualization 4.16 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-operator-rhel9@sha256:1fd1982cd924e70edd42d40fd0838494b5777fe865874bd5487f98e59c741b13_amd64 as a component of Red Hat Container Native Virtualization 4.16 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-server-rhel9@sha256:506ea70975ca36350c956850d6e3a87e1d59fad1aa3aa80b1468bfe0fcccf979_amd64 as a component of Red Hat Container Native Virtualization 4.16 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-controller-rhel9@sha256:75ab642244e0f1d4d02d27e9e93fa2835e473bcd75f90afcd1c4ac80d1068586_arm64 as a component of Red Hat Container Native Virtualization 4.16 | * |
| Red Hat | registry.redhat.io/container-native-virtualization/aaq-controller-rhel9@sha256:4988e8a7db4524568c2ac31569dd6fba455e62f5eca2eb0ec341ec04f12bab1f_amd64 |
Timeline
- Aug 11, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:53804 advisory
- https://access.redhat.com/security/cve/CVE-2026-33186 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53804.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2449833 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33186 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33186 advisory
- https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3 advisory