CVE-2026-33186 is an authorization bypass vulnerability in the gRPC-Go library caused by improper input validation of the HTTP/2 :path pseudo-header. Specifically, the vulnerability arises when the :path header omits the mandatory leading slash, allowing remote attackers to bypass defined authorization policies. This affects Red Hat OpenShift Container Platform versions prior to the fixed releases. Red Hat has issued security advisories and updated RPM packages and container images to remediate this issue. The vulnerability has a high severity rating with a CVSS v3 base score of 9.1 as rated by Red Hat, indicating high confidentiality and integrity impact but no availability impact. Mitigation includes upgrading to the patched versions or implementing infrastructure-level normalization of HTTP/2 :path headers.

The vulnerability allows remote attackers to bypass authorization controls in gRPC-Go by exploiting improper HTTP/2 :path header validation. This can lead to unauthorized access to services or information disclosure within Red Hat OpenShift Container Platform deployments. The CVSS v3 base score assigned by Red Hat is 9.1 (high severity), reflecting high confidentiality and integrity impact with no impact on availability. There are no known exploits in the wild at this time.

A fix is available and users should upgrade to the updated Red Hat OpenShift Container Platform packages and container images as provided in the Red Hat advisories (e.g., versions 4.19.29 and later). Additionally, infrastructure-level mitigation can be applied by configuring reverse proxies or API gateways to normalize and validate the HTTP/2 :path header, ensuring it includes the mandatory leading slash before requests reach the gRPC-Go server. Proper configuration and restarting of intermediaries is required to apply this mitigation. No contradictory vendor guidance exists; applying the official fix is recommended.