{"schema_version":"1.9.0","id":"CVE-2026-33186","published":"2026-03-20T22:23:32.147Z","modified":"2026-09-08T03:46:33.548039587Z","aliases":["GHSA-p77j-4mvh-x3m3","GO-2026-4762"],"related":["ALSA-2026:19135","ALSA-2026:19353","ALSA-2026:48790","SUSE-SU-2026:1194-1","SUSE-SU-2026:1195-1","SUSE-SU-2026:1197-1","SUSE-SU-2026:1198-1","SUSE-SU-2026:1200-1","SUSE-SU-2026:1205-1","SUSE-SU-2026:1208-1","SUSE-SU-2026:1314-1","SUSE-SU-2026:1395-1","SUSE-SU-2026:1411-1","SUSE-SU-2026:1524-1","SUSE-SU-2026:1951-1","SUSE-SU-2026:2101-1","SUSE-SU-2026:21115-1","SUSE-SU-2026:21128-1","SUSE-SU-2026:21210-1","SUSE-SU-2026:21272-1","SUSE-SU-2026:21370-1","SUSE-SU-2026:21490-1","SUSE-SU-2026:21560-1","SUSE-SU-2026:21630-1","SUSE-SU-2026:21732-1","SUSE-SU-2026:21756-1","SUSE-SU-2026:21793-1","SUSE-SU-2026:21803-1","SUSE-SU-2026:21827-1","SUSE-SU-2026:21849-1","SUSE-SU-2026:21870-1","SUSE-SU-2026:21989-1","SUSE-SU-2026:22050-1","SUSE-SU-2026:22051-1","SUSE-SU-2026:22053-1","SUSE-SU-2026:22065-1","SUSE-SU-2026:22066-1","SUSE-SU-2026:22074-1","SUSE-SU-2026:22075-1","SUSE-SU-2026:22101-1","SUSE-SU-2026:22128-1","SUSE-SU-2026:22133-1","SUSE-SU-2026:22141-1","SUSE-SU-2026:22242-1","SUSE-SU-2026:22249-1","SUSE-SU-2026:22328-1","SUSE-SU-2026:22376-1","SUSE-SU-2026:22423-1","SUSE-SU-2026:2243-1","SUSE-SU-2026:22442-1","SUSE-SU-2026:22558-1","SUSE-SU-2026:2258-1","SUSE-SU-2026:2347-1","SUSE-SU-2026:2400-1","SUSE-SU-2026:2401-1","SUSE-SU-2026:2438-1","SUSE-SU-2026:2466-1","SUSE-SU-2026:2493-1","SUSE-SU-2026:2581-1","SUSE-SU-2026:2609-1","SUSE-SU-2026:2611-1","SUSE-SU-2026:2612-1","SUSE-SU-2026:2639-1","SUSE-SU-2026:2640-1","SUSE-SU-2026:2665-1","SUSE-SU-2026:3056-1","SUSE-SU-2026:3057-1","openSUSE-RU-2026:21160-1","openSUSE-SU-2026:10407-1","openSUSE-SU-2026:10419-1","openSUSE-SU-2026:10420-1","openSUSE-SU-2026:10432-1","openSUSE-SU-2026:10474-1","openSUSE-SU-2026:10484-1","openSUSE-SU-2026:10523-1","openSUSE-SU-2026:10601-1","openSUSE-SU-2026:10612-1","openSUSE-SU-2026:10613-1","openSUSE-SU-2026:10618-1","openSUSE-SU-2026:10631-1","openSUSE-SU-2026:10651-1","openSUSE-SU-2026:10690-1","openSUSE-SU-2026:10700-1","openSUSE-SU-2026:10731-1","openSUSE-SU-2026:10771-1","openSUSE-SU-2026:10902-1","openSUSE-SU-2026:10921-1","openSUSE-SU-2026:11015-1","openSUSE-SU-2026:11057-1","openSUSE-SU-2026:11075-1","openSUSE-SU-2026:11091-1","openSUSE-SU-2026:11107-1","openSUSE-SU-2026:11126-1","openSUSE-SU-2026:11150-1","openSUSE-SU-2026:11153-1","openSUSE-SU-2026:11305-1","openSUSE-SU-2026:11402-1","openSUSE-SU-2026:11403-1","openSUSE-SU-2026:11410-1","openSUSE-SU-2026:20555-1","openSUSE-SU-2026:20584-1","openSUSE-SU-2026:20603-1","openSUSE-SU-2026:20620-1","openSUSE-SU-2026:20686-1","openSUSE-SU-2026:20730-1","openSUSE-SU-2026:20752-1","openSUSE-SU-2026:20761-1","openSUSE-SU-2026:20788-1","openSUSE-SU-2026:20809-1","openSUSE-SU-2026:20815-1","openSUSE-SU-2026:20856-1","openSUSE-SU-2026:20920-1","openSUSE-SU-2026:20921-1","openSUSE-SU-2026:20924-1","openSUSE-SU-2026:20940-1","openSUSE-SU-2026:20969-1","openSUSE-SU-2026:21010-1","openSUSE-SU-2026:21069-1","openSUSE-SU-2026:21205-1","openSUSE-SU-2026:21210-1","openSUSE-SU-2026:21213-1","openSUSE-SU-2026:21265-1","openSUSE-SU-2026:21483-1"],"summary":"gRPC-Go has an authorization bypass via missing leading slash in :path","details":"gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/grpc/grpc-go","events":[{"introduced":"0"},{"fixed":"dda86dbd9cecb8b35b58c73d507d81d67761205f"}],"database_specific":{"cpe":"cpe:2.3:a:grpc:grpc:*:*:*:*:*:go:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.79.3"}],"source":["AFFECTED_FIELD","CPE_RANGE"]}}],"versions":["v1.79.2","v1.79.1","v1.79.0","v1.79.0-dev","cmd/protoc-gen-go-grpc/v1.6.0","v1.78.0-dev","v1.77.0-dev","v1.76.0-dev","v1.75.0-dev","v1.74.0-dev","v1.73.0-dev","v1.72.0-dev","1.69.3","v1.71.0-dev","v1.69.0","v1.70.0-dev","v1.69.0-dev","v1.68.0-dev","v1.67.0-dev","cmd/protoc-gen-go-grpc/v1.5.1","cmd/protoc-gen-go-grpc/v1.5.0","security/advancedtls/v1.0.0","v1.66.0-dev","cmd/protoc-gen-go-grpc/v1.4.0","v1.65.0-dev","gcp/observability/v1.0.1","v1.61.0-dev","v1.60.0-dev","v1.59.0-dev","v1.58.0-dev","v1.57.0-dev","v1.56.0-dev","gcp/observability/v1.0.0","stats/opencensus/v1.0.0","v1.55.0-dev","cmd/protoc-gen-go-grpc/v1.3.0","v1.53.0-dev","v1.52.0-dev","v1.51.0-dev","v1.50.0-dev","v1.49.0-dev","v1.48.0-dev","v1.47.0-dev","v1.46.0-dev","v1.45.0-dev","cmd/protoc-gen-go-grpc/v1.2.0","v1.44.0-dev","v1.43.0-dev","v1.42.0-dev","v1.41.0-dev","v1.40.0-dev","v1.39.0-dev","v1.38.0-dev","v1.37.0-dev","cmd/protoc-gen-go-grpc/v1.1.0","v1.36.0-dev","v1.35.0-dev","cmd/protoc-gen-go-grpc/v1.0.1","v1.34.0-dev","cmd/protoc-gen-go-grpc/v1.0.0","v1.33.0-dev","v1.32.0-dev","v1.31.0-dev","v1.30.0-dev.1","v1.30.0-dev","v1.29.0-dev","v1.28.0-pre","v1.27.0-pre","v1.2.0","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1-GA","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33186.json"}}],"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33186.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10093"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10094"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10105"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10107"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10125"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10126"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10130"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10131"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10153"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10155"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10158"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10172"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10175"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10698"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10705"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10706"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11070"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11408"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11803"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11856"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11916"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11996"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12116"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12118"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12119"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12277"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12279"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12283"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12337"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13548"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13791"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13829"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14775"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:15092"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17123"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17448"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17459"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17468"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17474"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17475"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17598"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17599"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17789"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18068"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18585"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19099"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19108"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19109"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19135"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19207"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19353"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19375"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19719"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19720"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19721"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20034"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20035"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20041"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20042"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20088"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20089"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20322"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20436"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20943"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20946"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21657"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21658"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21691"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21692"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21696"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21697"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21703"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21704"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21709"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21710"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21769"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21931"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21932"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22347"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22423"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22450"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22465"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22485"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22645"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22689"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22714"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22800"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22937"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22959"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22961"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23228"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23234"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23235"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23241"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23246"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23247"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23345"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24484"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24506"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24535"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24536"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24759"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24853"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25009"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25045"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25127"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25182"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25183"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25187"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25194"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25195"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25201"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26412"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26413"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26416"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26420"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26519"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26568"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26997"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26999"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27001"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27004"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27063"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27076"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27856"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27892"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27893"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27901"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27957"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28047"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28893"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28964"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29079"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29082"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29854"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34049"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34097"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34099"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34100"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34364"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34769"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34794"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34795"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36611"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36621"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36651"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36796"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36882"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37192"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37580"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37585"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40022"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40030"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40118"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40792"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40795"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40945"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40984"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41019"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41928"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41941"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41944"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42049"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42051"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42150"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42151"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42240"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43225"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43227"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43253"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43331"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43692"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44233"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44235"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:47728"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:47952"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48699"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48790"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50758"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:50843"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:51033"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:53728"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:53763"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:53773"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:53804"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54191"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54274"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54286"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54531"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54757"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56366"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56431"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56789"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56854"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56912"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56959"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:57013"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:57365"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59833"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60146"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:61245"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6174"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6428"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6564"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6802"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7110"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7128"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7245"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8151"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8338"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8433"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8449"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8483"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8484"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8490"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8491"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8493"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9385"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9388"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9440"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9448"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9453"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9872"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-33186"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33186.json"},{"type":"ADVISORY","url":"https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33186"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449833"}],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-285"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33186.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}