security: CVE-2026-33186 — google.golang.org/grpc Authorization Bypass (CVSS 9.1 Critical)

[AndrewCharlesHay]

Summary

CVE-2026-33186 (GHSA-p77j-4mvh-x3m3) is a Critical (CVSS 9.1) authorization bypass vulnerability in google.golang.org/grpc published on 2026-03-17.

Vulnerability Details

Field	Value
CVE	CVE-2026-33186
GHSA	GHSA-p77j-4mvh-x3m3
Severity	Critical — CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CWE	CWE-285 (Improper Authorization), CWE-20 (Improper Input Validation)
Affected versions	google.golang.org/grpc < v1.79.3
Fixed in	google.golang.org/grpc v1.79.3

Description

The gRPC-Go server was too lenient in its routing logic, accepting requests where the HTTP/2 :path pseudo-header omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests, authorization interceptors (including grpc/authz) evaluated the raw, non-canonical path string — causing deny rules defined for canonical paths to fail to match, allowing the request to bypass the policy via a fallback allow rule.

Who is impacted: gRPC-Go servers that use path-based authorization interceptors (such as google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod) and have security policies with specific deny rules but permissive fallback allow rules.

Impact on this Repository

Most modules in this repository are already on v1.79.3 (patched). One module remains on a vulnerable version:

Module	Current version	Status
pkg/dyninst/testprogs/progs	v1.73.0	⚠️ Vulnerable

All other modules (go.mod, pkg/util/grpc, pkg/proto, pkg/trace, etc.) are already on v1.79.3.

Fix

A PR is open at https://github.com/AndrewCharlesHay/datadog-agent/pull/1 that bumps pkg/dyninst/testprogs/progs/go.mod from grpc v1.73.0 → v1.79.3.

References

• grpc-go security advisory GHSA-p77j-4mvh-x3m3
• grpc-go v1.79.3 release
• Go vulnerability database

[ajwerner]

This module is just used to generate programs to test the debugger functionality against. Importantly some of these programs run go 1.23. I think this bump would force those programs to 1.24, which defeats the purpose of the testing. This code is never shipped anywhere

[ajwerner]

Closing due to the above explanation