VDB
RHSA-2026:85846
RHSA-2026:85846
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhmtc/openshift-migration-must-gather-rhel8@sha256:d33fb4bdee76f0918290730b5688d5076bc3a03ca17eabb2282b690baa2e3823_amd64 as a component of Red Hat Migration Toolkit 1.8 | * |
| Red Hat | registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8@sha256:4baa83f5371408ebddb4ad5ba8ff3d0302741d38d68722a657725db5675bb6e6_amd64 as a component of Red Hat Migration Toolkit 1.8 | * |
| Red Hat | registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8@sha256:f3ac630ce3326cd8ac4f2bf2790225554448a764d1749ccc0c909dad34bc959b_amd64 as a component of Red Hat Migration Toolkit 1.8 | * |
| Red Hat | registry.redhat.io/rhmtc/openshift-migration-registry-rhel8@sha256:18ebd0ba10e18489be7cf24abfa27c3e1f5bda5ea13d09e16c8d62ff5e98dd4d_amd64 as a component of Red Hat Migration Toolkit 1.8 | * |
| Red Hat | registry.redhat.io/rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:eda9ed5d5ab45e26137448a990aede8897cfbf4cb1b64602a2d9b65b91eab8fd_amd64 as a component of Red Hat Migration Toolkit 1.8 | * |
| Red Hat | registry.redhat.io/rhmtc/openshift-migration-ui-rhel8@sha256:925bb7b6d90dced96241dc85d60121f7a0295dd91cc09b5aa6bb8ec8f5b0d357_amd64 as a component of Red Hat Migration Toolkit 1.8 | * |
| Red Hat | registry.redhat.io/rhmtc/openshift-migration-rhel8-operator@sha256:020d2163047b69b0334a51ab998253d69816a5c3b2dee76586ce75ff8e2f0dbb_amd64 as a component of Red Hat Migration Toolkit 1.8 | * |
| Red Hat | registry.redhat.io/rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:df220ef2d49dc5df3479fe7c3f4a1e3299e04469a1e50f972d0583e4140c950e_amd64 as a component of Red Hat Migration Toolkit 1.8 | * |
| Red Hat | registry.redhat.io/rhmtc/openshift-migration-controller-rhel8@sha256:8d5475fcf0ad9fa2086593951ebb6203d93ca8cd3ac006e953a25831be741850_amd64 as a component of Red Hat Migration Toolkit 1.8 | * |
| Red Hat | registry.redhat.io/rhmtc/openshift-migration-openvpn-rhel8@sha256:3a14afc044286044f7f5bac6d6a6c582028a3d051aac263be9ed143d06b8e77f_amd64 as a component of Red Hat Migration Toolkit 1.8 | * |
| Red Hat | registry.redhat.io/rhmtc/openshift-migration-operator-bundle@sha256:868ab9f337db3fc4b259704683e02be3c603b18fc1d92d941f89c9595142445a_amd64 as a component of Red Hat Migration Toolkit 1.8 | * |
Timeline
- Oct 20, 2026 CVE Published
- Oct 26, 2026 CVE Updated
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:85846 advisory
- https://access.redhat.com/security/cve/CVE-2026-33186 advisory
- https://access.redhat.com/security/cve/CVE-2026-59879 advisory
- https://access.redhat.com/security/cve/CVE-2026-69153 advisory
- https://access.redhat.com/security/cve/CVE-2026-84445 advisory
- https://access.redhat.com/security/cve/CVE-2026-87776 advisory
- https://access.redhat.com/security/cve/CVE-2026-88031 advisory
- https://access.redhat.com/security/cve/CVE-2026-90711 advisory
- https://access.redhat.com/security/cve/CVE-2026-92599 advisory
- https://access.redhat.com/security/cve/CVE-2026-93749 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/migration_toolkit_for_containers/index advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85846.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2449833 issue
- https://www.cve.org/CVERecord?id=CVE-2026-33186 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-33186 advisory
- https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2498158 issue
- https://www.cve.org/CVERecord?id=CVE-2026-59879 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59879 advisory
…and 50 more