GHSA-46wh-3698-f2cx

Suggest an improvement
Source
https://github.com/advisories/GHSA-46wh-3698-f2cx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-46wh-3698-f2cx/GHSA-46wh-3698-f2cx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-46wh-3698-f2cx
Aliases
Downstream
CGA (8)
MINI (3)
Published
2026-03-29T15:37:28Z
Modified
2026-09-10T03:50:36Z
Severity
  • 7.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)
Details

Summary

There is a potential vulnerability in Traefik due to its dependency on an affected version of gRPC-Go (CVE-2026-33186).

A remote, unauthenticated attacker can send gRPC requests with a malformed HTTP/2 :path pseudo-header omitting the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server routes such requests correctly, path-based authorization interceptors evaluate the raw non-canonical path and fail to match "deny" rules, allowing the request to bypass the policy entirely if a fallback "allow" rule is present.

Patches

For more information

If there are any questions or comments about this advisory, please open an issue.

Original Description

Summary

This CVE hits traefik until Version 3.6.11 and 2.11.41. gRPC-Go has an authorization bypass via missing leading slash in :path

Details

As described in https://github.com/advisories/GHSA-p77j-4mvh-x3m3

PoC

Update library version in https://github.com/traefik/traefik/blob/67c64ed9b25fbb90f1086977a62827133a7aa01b/go.mod#L108

Impact

Is described in https://github.com/advisories/GHSA-p77j-4mvh-x3m3

Database specific 
{
    "cwe_ids":  [
        "CWE-1395",
        "CWE-285"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-29T15:37:28Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

Go / github.com/traefik/traefik/v2

Package

Name
github.com/traefik/traefik/v2
View open source insights on deps.dev
Purl
pkg:golang/github.com/traefik/traefik/v2

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.11.42

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-46wh-3698-f2cx/GHSA-46wh-3698-f2cx.json"

Go / github.com/traefik/traefik/v3

Package

Name
github.com/traefik/traefik/v3
View open source insights on deps.dev
Purl
pkg:golang/github.com/traefik/traefik/v3

Affected ranges

Type
SEMVER
Events
Introduced
3.0.0-beta3
Fixed
3.6.12

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-46wh-3698-f2cx/GHSA-46wh-3698-f2cx.json"

Go / github.com/traefik/traefik/v3

Package

Name
github.com/traefik/traefik/v3
View open source insights on deps.dev
Purl
pkg:golang/github.com/traefik/traefik/v3

Affected ranges

Type
SEMVER
Events
Introduced
3.7.0-ea.1
Fixed
3.7.0-ea.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-46wh-3698-f2cx/GHSA-46wh-3698-f2cx.json"