Every CVESearch/Get API key

GHSA-46wh-3698-f2cx

Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)

7.8 HighFix available

GHSA-46wh-3698-f2cx is a high vulnerability (CVSS 7.8) in github.com/traefik/traefik, published March 29, 2026. No source lists public exploit code. Fixed in github.com/traefik/traefik/v2 2.11.42.

What does this mean?
Severity
7.8 HighCVSS 4.0, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.11.42github.com/traefik/traefik/v2 +4 more

Description

Summary

There is a potential vulnerability in Traefik due to its dependency on an affected version of gRPC-Go (CVE-2026-33186).

A remote, unauthenticated attacker can send gRPC requests with a malformed HTTP/2 :path pseudo-header omitting the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server routes such requests correctly, path-based authorization interceptors evaluate the raw non-canonical path and fail to match "deny" rules, allowing the request to bypass the policy entirely if a fallback "allow" rule is present.

Patches

For more information

If there are any questions or comments about this advisory, please open an issue.

<details> <summary>Original Description</summary>

Summary

This CVE hits traefik until Version 3.6.11 and 2.11.41. gRPC-Go has an authorization bypass via missing leading slash in :path

Details

As described in https://github.com/advisories/GHSA-p77j-4mvh-x3m3

PoC

Update library version in https://github.com/traefik/traefik/blob/67c64ed9b25fbb90f1086977a62827133a7aa01b/go.mod#L108

Impact

Is described in https://github.com/advisories/GHSA-p77j-4mvh-x3m3

</details>

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Affected packages

Affected packages
PackageAffectedFixed
github.com/traefik/traefik/v2
Go
before 2.11.42
2.11.42
github.com/traefik/traefik/v3
Go
3.0.0-beta3 up to 3.6.12
3.6.12
github.com/traefik/traefik/v3
Go
3.7.0-ea.1 up to 3.7.0-ea.3
3.7.0-ea.3
github.com/traefik/traefik
Go
All versionsNone known
github.com/traefik/traefik/v3
Go
3.0.0-beta3 up to 3.6.12, 3.7.0-ea.1 up to 3.7.0-ea.3
3.6.123.7.0-ea.3

What each source reports

GitHub Advisories Score used7.8

Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)

Summary

There is a potential vulnerability in Traefik due to its dependency on an affected version of gRPC-Go (CVE-2026-33186).

A remote, unauthenticated attacker can send gRPC requests with a malformed HTTP/2 :path pseudo-header omitting the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server routes such requests correctly, path-based authorization interceptors evaluate the raw non-canonical path and fail to match "deny" rules, allowing the request to bypass the policy entirely if a fallback "allow" rule is present.

Patches

For more information

If there are any questions or comments about this advisory, please open an issue.

<details> <summary>Original Description</summary>

Summary

This CVE hits traefik until Version 3.6.11 and 2.11.41. gRPC-Go has an authorization bypass via missing leading slash in :path

Details

As described in https://github.com/advisories/GHSA-p77j-4mvh-x3m3

PoC

Update library version in https://github.com/traefik/traefik/blob/67c64ed9b25fbb90f1086977a62827133a7aa01b/go.mod#L108

Impact

Is described in https://github.com/advisories/GHSA-p77j-4mvh-x3m3

</details>

Record
GHSA-46wh-3698-f2cx
CVSS 4.0
7.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-285, CWE-1395
Updated
2026-11-02
OSV7.8

Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)

Summary

There is a potential vulnerability in Traefik due to its dependency on an affected version of gRPC-Go (CVE-2026-33186).

A remote, unauthenticated attacker can send gRPC requests with a malformed HTTP/2 :path pseudo-header omitting the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server routes such requests correctly, path-based authorization interceptors evaluate the raw non-canonical path and fail to match "deny" rules, allowing the request to bypass the policy entirely if a fallback "allow" rule is present.

Patches

For more information

If there are any questions or comments about this advisory, please open an issue.

<details> <summary>Original Description</summary>

Summary

This CVE hits traefik until Version 3.6.11 and 2.11.41. gRPC-Go has an authorization bypass via missing leading slash in :path

Details

As described in https://github.com/advisories/GHSA-p77j-4mvh-x3m3

PoC

Update library version in https://github.com/traefik/traefik/blob/67c64ed9b25fbb90f1086977a62827133a7aa01b/go.mod#L108

Impact

Is described in https://github.com/advisories/GHSA-p77j-4mvh-x3m3

</details>

Record
GHSA-46wh-3698-f2cx
CVSS 4.0
7.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Weakness
CWE-1395, CWE-285
Updated
2026-11-02
OSVGO-2026-4897No score

Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186) in github.com/traefik/traefik

Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186) in github.com/traefik/traefik

Record
GO-2026-4897
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open