This vulnerability affects gRPC-Go, the Go language implementation of gRPC, where improper input validation of the HTTP/2 :path pseudo-header allows an attacker to bypass authorization checks by sending raw HTTP/2 frames with a malformed :path missing the leading slash. This can lead to unauthorized access or information disclosure. Red Hat OpenShift Container Platform 4.12.91 includes updates that fix this issue. The recommended mitigation is to configure reverse proxies or API gateways to normalize and validate incoming :path headers before they reach the gRPC-Go server. The vulnerability is tracked as CVE-2026-33186 and has a Red Hat CVSS v3 base score of 9.1, indicating high severity.

The vulnerability allows remote attackers to bypass authorization mechanisms in gRPC-Go by exploiting improper HTTP/2 :path header validation. This can result in unauthorized access to services or sensitive information disclosure. Red Hat rates the impact as high with a CVSS v3 score of 9.1, reflecting high confidentiality and integrity impact without affecting availability. There are no known exploits in the wild at this time.

Red Hat OpenShift Container Platform 4.12.91 includes updates that address this vulnerability. Users should upgrade to this version or later when available. Additionally, implement infrastructure-level normalization by configuring reverse proxies or API gateways to validate and ensure all incoming HTTP/2 :path headers include the mandatory leading slash before reaching the gRPC-Go server. Proper configuration and restarting of these intermediaries are necessary to apply the mitigation. No other immediate actions are required.