GHSA-hrxh-6v49-42gf

High

Published: —Translated: 27/07/2026(UTC)NVD NIST

Summary

Multiple security vulnerabilities have been identified in the grpc-go library affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation. These vulnerabilities could lead to authorization bypass (Fail-Open) during rule translation.

Risk Assessment

The risk for the organization includes unauthorized access to resources protected by RBAC rules, potentially leading to data confidentiality and integrity breaches.

Recommendation

It is recommended to immediately update the grpc-go library to the latest version containing security fixes. Also review the xDS RBAC configuration to ensure it is not operating in Fail-Open mode.

Other vulnerabilities in grpc-go

CVE-2026-33186Critical
A vulnerability in gRPC-Go before version 1.79.3 allows authorization bypass due to improper validation of the HTTP/2 `:path` pseudo-header. The server accepted requests with a missing leading slash (e.g., `Service/Method` instead of `/Service/Method`), causing deny rules based on canonical paths to be ineffective. An attacker can exploit this to bypass security policies if a fallback allow rule exists.

Original NVD description (English source)

Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in: - Authorization Bypass (Fail-Open) when transla