gRPC-Go versions before 1.79.3 improperly validate the HTTP/2 :path pseudo-header by accepting paths without the mandatory leading slash (e.g., 'Service/Method' instead of '/Service/Method'). While the server routes these requests correctly, authorization interceptors evaluate the raw, non-canonical path, causing deny rules defined with canonical paths to fail to match. This leads to an authorization bypass if fallback allow rules exist. The vulnerability affects grpc-go servers that use path-based authorization interceptors such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx). A remote attacker can exploit this by sending malformed HTTP/2 frames with a :path missing the leading slash, potentially gaining unauthorized access or causing information disclosure. Red Hat has acknowledged this issue affecting OpenShift Container Platform and advises upgrading to fixed package versions. Mitigation can also be achieved by normalizing the :path header at the proxy or API gateway level before requests reach the grpc-go server.

The vulnerability allows remote attackers to bypass authorization policies on grpc-go servers that rely on path-based authorization interceptors. This can lead to unauthorized access to services or information disclosure. The CVSS v3.1 base score is 9.1 (critical), reflecting high confidentiality and integrity impact with no required privileges or user interaction. There are no known exploits in the wild as of the latest information. Red Hat rates the impact as low for their OpenShift Container Platform packages but acknowledges the underlying criticality of the flaw.

A fix is available in grpc-go version 1.79.3 and later. Users should upgrade to this or later versions to remediate the vulnerability. For environments where immediate upgrade is not possible, implement infrastructure-level normalization of the HTTP/2 :path pseudo-header to ensure it includes the mandatory leading slash before reaching the grpc-go server. This can be done by configuring a reverse proxy or API gateway to validate and normalize incoming requests. Ensure any such intermediary is properly configured and restarted to apply changes. Red Hat OpenShift Container Platform users should upgrade to the 4.13.67 release or later when available. No other vendor-provided fixes or mitigations are noted. Patch status is confirmed by Red Hat advisories.