{"schema_version":"1.3.1","id":"GO-2026-4762","modified":"2026-03-27T18:39:44Z","published":"2026-03-27T18:39:44Z","aliases":["CVE-2026-33186","GHSA-p77j-4mvh-x3m3"],"summary":"Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc","details":"Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc","affected":[{"package":{"name":"google.golang.org/grpc","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.79.3"}]}],"ecosystem_specific":{"imports":[{"path":"google.golang.org/grpc","symbols":["Server.Serve","Server.ServeHTTP","Server.handleStream"]}]}}],"references":[{"type":"ADVISORY","url":"https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-4762","review_status":"REVIEWED"}}