The Red Hat security advisory RHSA-2026:10153 addresses multiple vulnerabilities including CVE-2026-33186, an authorization bypass in the gRPC-Go implementation used by Red Hat products. This flaw arises from improper validation of the HTTP/2 :path pseudo-header, specifically when the mandatory leading slash is omitted, enabling attackers to circumvent security controls. The advisory covers Red Hat Trusted Artifact Signer (RHTAS) versions including 1.3.4 and Red Hat Migration Toolkit for Applications 8.1. Red Hat has not yet released patches for these vulnerabilities. Mitigation involves configuring infrastructure components such as reverse proxies or API gateways to normalize and validate HTTP/2 :path headers before they reach the vulnerable services. The advisory includes multiple related CVEs but does not provide CVSS scores. Red Hat rates the severity as high based on the impact of unauthorized access and information disclosure risks.

Successful exploitation of CVE-2026-33186 can lead to bypassing authorization mechanisms, potentially granting unauthorized access to services or sensitive information. This undermines the integrity of access controls in affected Red Hat products. The advisory does not report any known active exploitation in the wild. The impact is considered high due to the possibility of unauthorized access and information disclosure. Other vulnerabilities referenced in the advisory may have additional impacts but are not detailed in the provided data.

Red Hat has not yet released official patches or fixes for these vulnerabilities. The recommended mitigation for CVE-2026-33186 is to implement infrastructure-level normalization of HTTP/2 :path headers by configuring reverse proxies or API gateways to validate and enforce the presence of a leading slash in the :path header. This mitigation reduces the risk of authorization bypass without requiring immediate code changes. Ensure that any intermediary devices are properly configured and restarted to apply these changes. Monitor Red Hat advisories for updates regarding official fixes.