gRPC-Go versions before 1.79.3 accept HTTP/2 requests whose :path pseudo-header lacks the required leading slash, such as Service/Method. The server routes these non‑canonical paths to the correct handler but authorization interceptors evaluate the raw path string. As a result, deny rules that match canonical paths such as /Service/Method do not match the malformed request, and a fallback allow rule grants access. This flaw is a direct authorization bypass that can expose confidential data or perform privileged operations that are otherwise restricted.

The vulnerability affects any grpc-go server running a version older than 1.79.3 that relies on path‑based authorization, including the official grpc/authz RBAC implementation or custom interceptors that use info.FullMethod or grpc.Method(ctx). No other protocols or unrelated products are impacted.

The CVSS base score of 9.1 reflects the high severity of this flaw. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit it remotely by sending raw HTTP/2 frames with a malformed :path header directly to the gRPC server. If the server’s firewall or load balancer permits such traffic, the attacker can bypass authorization checks and invoke restricted RPCs. The impact is limited to the services exposed by the gRPC server, but the consequences are significant for sensitive or privileged operations.