What is the CVSS score of EUVD-2026-13830?

EUVD-2026-13830 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for EUVD-2026-13830?

Yes, a public proof-of-concept exploit is available for EUVD-2026-13830. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-13830?

Within 24 hours: Inventory all gRPC-Go deployments and identify services using path-based authorization controls; implement network segmentation to restrict gRPC service exposure. Within 7 days: Deploy WAF rules to detect and block malformed HTTP/2 :path pseudo-headers lacking leading slashes; enable enhanced logging and monitoring for authorization anomalies. Within 30 days: Evaluate vendor patches as they become available; consider migrating to alternative authentication mechanisms (mTLS, token-based) independent of path validation; conduct security audit of all accessed gRPC services.

Google EUVD-2026-13830

Q: Which versions of Google are affected by EUVD-2026-13830?

A critical authorization bypass vulnerability in gRPC-Go (CVE-2026-33186, CVSS 9.1) allows unauthenticated attackers to bypass access controls and access restricted services over the network without…. A patch is available.

| CVE-2026-33186 CRITICAL

Improper Authorization (CWE-285)

2026-03-18 https://github.com/grpc/grpc-go

GHSA-p77j-4mvh-x3m3

Authentication Bypass Google Nginx Canonical

9.1

CVSS 3.1 · Vendor: https://github.com/grpc/grpc-go

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft HTTP/2 request with malformed :path pseudo-header
Exploit

Omit leading slash in path string
Execution

Bypass authorization interceptor evaluation
Impact

Access protected gRPC service method

Vulnerability Assessment

Weakness	CWE CWE-285 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization verification MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	gRPC-Go server with authorization interceptors enabled (including grpc/authz package). Attacker sends HTTP/2 requests with malformed `:path` pseudo-header omitting leading slash (e.g., `Service/Method` instead of `/Service/Method`). Remote unauthenticated exploitation; no victim interaction required.
Impact	The real-world risk is significant but context-dependent. The CVSS 3.1 score of 9.1 reflects network accessibility (AV:N), low attack complexity (AC:L), no required privileges (PR:N), and no user interaction (UI:N), with high confidentiality and integrity impact. However, exploitation requires two specific conditions: the target must use path-based authorization with specific deny rules and a fallback allow policy, and attackers must send raw HTTP/2 frames directly to the gRPC server. Organizations using default-deny policies or infrastructure-level HTTP/2 validation are not vulnerable. The vulnerability is more likely to affect internal microservices architectures where gRPC servers are directly exposed without strict proxy validation. No EPSS score or KEV status is provided in the intelligence, and no public proof-of-concept is explicitly mentioned, suggesting limited observed exploitation. Patches are available in v1.79.3, making this a high-priority remediation for affected configurations rather than a universal critical emergency.
Exploit ScenarioDerived	An attacker identifies a gRPC-Go microservice protected by path-based authorization that denies access to '/admin/DeleteUser' but allows other paths by default. The attacker crafts a raw HTTP/2 frame with the :path pseudo-header set to 'admin/DeleteUser' (without the leading slash) and sends it directly to the gRPC server. The malformed path bypasses the authorization interceptor's deny rule because it fails to match the canonical '/admin/DeleteUser' pattern, and the request proceeds to the handler under the fallback allow policy, granting unauthorized access to delete user accounts or exfiltrate sensitive administrative data.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 18, 2026

An authorization bypass vulnerability in gRPC-Go allows attackers to circumvent path-based access control by sending HTTP/2 requests with malformed :path pseudo-headers that omit the mandatory leading slash (e.g., 'Service/Method' instead of '/Service/Method'). This affects gRPC-Go servers using path-based authorization interceptors like google.golang.org/grpc/authz with deny rules for canonical paths but fallback allow rules. The vulnerability has a CVSS score of 9.1 (Critical) with network-based exploitation requiring no privileges or user interaction, enabling attackers to access restricted services and potentially exfiltrate or modify sensitive data.

RemediationAI

Upgrade gRPC-Go to version 1.79.3 or later, which rejects requests with :path pseudo-headers lacking a leading slash with a codes.Unimplemented error before reaching authorization interceptors (see advisory at https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3). If immediate patching is not feasible, implement a path validation interceptor as the outermost interceptor in the chain that checks if info.FullMethod is empty or does not start with '/' and returns an error before any authorization logic executes. Alternatively, configure reverse proxies (Envoy, NGINX) or load balancers to enforce strict HTTP/2 compliance and reject or normalize malformed :path headers. Organizations should also consider hardening authorization policies to use a default-deny posture, explicitly allowlisting permitted paths rather than denying specific paths with a fallback allow rule.

Affected VersionsENISA

grpc-go < 1.79.3

Affected Packages

go google.golang.org/grpc fix: 1.79.3

euvd grpc_go fix: 1.79.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability affects google.golang.org/grpc (gRPC-Go), the Go implementation of Google's Remote Procedure Call framework that uses HTTP/2 as its transport protocol. The issue stems from CWE-285 (Improper Authorization) where the gRPC-Go server's routing logic accepted non-canonical :path pseudo-headers without a leading slash, violating HTTP/2 RFC specifications. While the server correctly routed these malformed requests to handlers, authorization interceptors evaluated the raw path string. This created a mismatch where deny rules written for canonical paths (starting with '/') failed to match the malformed input, allowing requests to bypass authorization checks if a fallback allow rule existed. The vulnerability exploits the difference between the server's lenient path acceptance and the interceptor's string-matching logic.

Know when Nginx gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/grpc/grpc-go) PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SUSE CRITICAL

Red Hat 8.1 HIGH

Primary rating from Vendor (https://github.com/grpc/grpc-go).

CVSS VectorVendor: https://github.com/grpc/grpc-go

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 18, 2026 - 20:10 nvd

CRITICAL 9.1

DescriptionCVE.org

Impact

_What kind of vulnerability is it? Who is impacted?_

It is an Authorization Bypass resulting from Improper Input Validation of the HTTP/2 :path pseudo-header.

The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present.

Who is impacted? This affects gRPC-Go servers that meet both of the following criteria:

They use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx).
Their security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule).

The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server.

Patches

_Has the problem been patched? What versions should users upgrade to?_

Yes, the issue has been patched. The fix ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string.

Users should upgrade to the following versions (or newer):

v1.79.3
The latest master branch.

It is recommended that all users employing path-based authorization (especially grpc/authz) upgrade as soon as the patch is available in a tagged release.

Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods:

1. Use a Validating Interceptor (Recommended Mitigation)

Add an "outermost" interceptor to your server that validates the path before any other authorization logic runs:

func pathValidationInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
    if info.FullMethod == "" || info.FullMethod[0] != '/' {
        return nil, status.Errorf(codes.Unimplemented, "malformed method name")
    }
    return handler(ctx, req)
}

// Ensure this is the FIRST interceptor in your chain
s := grpc.NewServer(
    grpc.ChainUnaryInterceptor(pathValidationInterceptor, authzInterceptor),
)

2. Infrastructure-Level Normalization

If your gRPC server is behind a reverse proxy or load balancer (such as Envoy, NGINX, or an L7 Cloud Load Balancer), ensure it is configured to enforce strict HTTP/2 compliance for pseudo-headers and reject or normalize requests where the :path header does not start with a leading slash.

3. Policy Hardening

Switch to a "default deny" posture in your authorization policies (explicitly listing all allowed paths and denying everything else) to reduce the risk of bypasses via malformed inputs.

Executive ViewAI

Why It Matters

A critical authorization bypass vulnerability in gRPC-Go (CVE-2026-33186, CVSS 9.1) allows unauthenticated attackers to bypass access controls and access restricted services over the network without requiring user interaction. Organizations running gRPC-Go services are at immediate risk of unauthorized data access, modification, or exfiltration, with no vendor patch currently available.

Business Impact: Severe

Compensating Controls

Implement HTTP/2 WAF rules to reject requests with malformed :path pseudo-headers; enforce network segmentation restricting gRPC service access to trusted sources only; deploy mTLS authentication as primary access control independent of path validation; disable gRPC services not actively in use; implement request filtering at reverse proxy/load balancer to normalize and validate :path headers before reaching gRPC-Go servers; enable comprehensive audit logging to detect exploitation attempts.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Related Vulnerabilities in gRPC Authorization and Header Bypass

View all 2

CVE-2026-33040 HIGH

8.7

More in Nginx

View all

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2013-2028 HIGH Act Now POC

7.5 Jul 20

The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau

CVE-2025-1974 CRITICAL Act Now POC

9.8 Mar 25

A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access

CVE-2013-4547 HIGH Act Now POC

7.5 Nov 23

nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap

CVE-2023-50919 CRITICAL Emergency POC

9.8 Jan 12

An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2017-7529 HIGH Act Now

7.5 Jul 13

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi

CVE-2016-0742 HIGH Act Now

7.5 Feb 15

The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid

CVE-2025-1098 HIGH Act Now POC

8.8 Mar 25

Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress

CVE-2025-24514 HIGH Act Now POC

8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres

CVE-2025-1097 HIGH Act Now POC

8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c

CVE-2022-31137 CRITICAL Act Now POC

9.8 Jul 08

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8

CVE-2014-3556 MEDIUM This Month

6.8 Dec 29

The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and

Same weakness CWE-285 – Improper Authorization

View all

CVE-2025-29927 CRITICAL POC

9.1

CVE-2016-5676 HIGH POC

7.5

CVE-2026-58704 HIGH POC

8.8

CVE-2025-66301 HIGH POC

8.6

CVE-2023-32707 HIGH POC

8.8

CVE-2016-3352 HIGH

8.8

CVE-2025-29659 CRITICAL POC

9.8

CVE-2022-2595 CRITICAL POC

10.0

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand	Affected
SUSE Linux Enterprise High Performance Computing 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Server 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Server 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Module for Public Cloud 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back