Vulnerability-Lookup

OPENSUSE-SU-2026:10700-1

Vulnerability from csaf_opensuse - Published: 2026-05-06 00:00 - Updated: 2026-05-06 00:00

Summary

apptainer-1.4.5-4.1 on GA media

Severity

Moderate

Notes

Title of the patch: apptainer-1.4.5-4.1 on GA media

Description of the patch: These are all security issues fixed in the apptainer-1.4.5-4.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-10700

CVE-2026-24137

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-33186

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-34986

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

References

URL

Category

	https://www.suse.com/support/security/rating/	external
	https://ftp.suse.com/pub/projects/security/csaf/o…	self
	https://www.suse.com/security/cve/CVE-2026-24137/	self
	https://www.suse.com/security/cve/CVE-2026-33186/	self
	https://www.suse.com/security/cve/CVE-2026-34986/	self
	https://www.suse.com/security/cve/CVE-2026-24137	external
	https://bugzilla.suse.com/1257137	external
	https://www.suse.com/security/cve/CVE-2026-33186	external
	https://bugzilla.suse.com/1260085	external
	https://www.suse.com/security/cve/CVE-2026-34986	external
	https://bugzilla.suse.com/1262805	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "apptainer-1.4.5-4.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the apptainer-1.4.5-4.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10700",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10700-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-24137 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-24137/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33186 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33186/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34986 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34986/"
      }
    ],
    "title": "apptainer-1.4.5-4.1 on GA media",
    "tracking": {
      "current_release_date": "2026-05-06T00:00:00Z",
      "generator": {
        "date": "2026-05-06T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10700-1",
      "initial_release_date": "2026-05-06T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-05-06T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apptainer-1.4.5-4.1.aarch64",
                "product": {
                  "name": "apptainer-1.4.5-4.1.aarch64",
                  "product_id": "apptainer-1.4.5-4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "apptainer-leap-1.4.5-4.1.aarch64",
                "product": {
                  "name": "apptainer-leap-1.4.5-4.1.aarch64",
                  "product_id": "apptainer-leap-1.4.5-4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "apptainer-sle15_7-1.4.5-4.1.aarch64",
                "product": {
                  "name": "apptainer-sle15_7-1.4.5-4.1.aarch64",
                  "product_id": "apptainer-sle15_7-1.4.5-4.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "apptainer-sle16-1.4.5-4.1.aarch64",
                "product": {
                  "name": "apptainer-sle16-1.4.5-4.1.aarch64",
                  "product_id": "apptainer-sle16-1.4.5-4.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apptainer-1.4.5-4.1.ppc64le",
                "product": {
                  "name": "apptainer-1.4.5-4.1.ppc64le",
                  "product_id": "apptainer-1.4.5-4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "apptainer-leap-1.4.5-4.1.ppc64le",
                "product": {
                  "name": "apptainer-leap-1.4.5-4.1.ppc64le",
                  "product_id": "apptainer-leap-1.4.5-4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "apptainer-sle15_7-1.4.5-4.1.ppc64le",
                "product": {
                  "name": "apptainer-sle15_7-1.4.5-4.1.ppc64le",
                  "product_id": "apptainer-sle15_7-1.4.5-4.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "apptainer-sle16-1.4.5-4.1.ppc64le",
                "product": {
                  "name": "apptainer-sle16-1.4.5-4.1.ppc64le",
                  "product_id": "apptainer-sle16-1.4.5-4.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apptainer-1.4.5-4.1.s390x",
                "product": {
                  "name": "apptainer-1.4.5-4.1.s390x",
                  "product_id": "apptainer-1.4.5-4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "apptainer-leap-1.4.5-4.1.s390x",
                "product": {
                  "name": "apptainer-leap-1.4.5-4.1.s390x",
                  "product_id": "apptainer-leap-1.4.5-4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "apptainer-sle15_7-1.4.5-4.1.s390x",
                "product": {
                  "name": "apptainer-sle15_7-1.4.5-4.1.s390x",
                  "product_id": "apptainer-sle15_7-1.4.5-4.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "apptainer-sle16-1.4.5-4.1.s390x",
                "product": {
                  "name": "apptainer-sle16-1.4.5-4.1.s390x",
                  "product_id": "apptainer-sle16-1.4.5-4.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apptainer-1.4.5-4.1.x86_64",
                "product": {
                  "name": "apptainer-1.4.5-4.1.x86_64",
                  "product_id": "apptainer-1.4.5-4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "apptainer-leap-1.4.5-4.1.x86_64",
                "product": {
                  "name": "apptainer-leap-1.4.5-4.1.x86_64",
                  "product_id": "apptainer-leap-1.4.5-4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "apptainer-sle15_7-1.4.5-4.1.x86_64",
                "product": {
                  "name": "apptainer-sle15_7-1.4.5-4.1.x86_64",
                  "product_id": "apptainer-sle15_7-1.4.5-4.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "apptainer-sle16-1.4.5-4.1.x86_64",
                "product": {
                  "name": "apptainer-sle16-1.4.5-4.1.x86_64",
                  "product_id": "apptainer-sle16-1.4.5-4.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-1.4.5-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-1.4.5-4.1.aarch64"
        },
        "product_reference": "apptainer-1.4.5-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-1.4.5-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-1.4.5-4.1.ppc64le"
        },
        "product_reference": "apptainer-1.4.5-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-1.4.5-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-1.4.5-4.1.s390x"
        },
        "product_reference": "apptainer-1.4.5-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-1.4.5-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-1.4.5-4.1.x86_64"
        },
        "product_reference": "apptainer-1.4.5-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-leap-1.4.5-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.aarch64"
        },
        "product_reference": "apptainer-leap-1.4.5-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-leap-1.4.5-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.ppc64le"
        },
        "product_reference": "apptainer-leap-1.4.5-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-leap-1.4.5-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.s390x"
        },
        "product_reference": "apptainer-leap-1.4.5-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-leap-1.4.5-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.x86_64"
        },
        "product_reference": "apptainer-leap-1.4.5-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-sle15_7-1.4.5-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.aarch64"
        },
        "product_reference": "apptainer-sle15_7-1.4.5-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-sle15_7-1.4.5-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.ppc64le"
        },
        "product_reference": "apptainer-sle15_7-1.4.5-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-sle15_7-1.4.5-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.s390x"
        },
        "product_reference": "apptainer-sle15_7-1.4.5-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-sle15_7-1.4.5-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.x86_64"
        },
        "product_reference": "apptainer-sle15_7-1.4.5-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-sle16-1.4.5-4.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.aarch64"
        },
        "product_reference": "apptainer-sle16-1.4.5-4.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-sle16-1.4.5-4.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.ppc64le"
        },
        "product_reference": "apptainer-sle16-1.4.5-4.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-sle16-1.4.5-4.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.s390x"
        },
        "product_reference": "apptainer-sle16-1.4.5-4.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apptainer-sle16-1.4.5-4.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.x86_64"
        },
        "product_reference": "apptainer-sle16-1.4.5-4.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-24137",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-24137"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apptainer-1.4.5-4.1.aarch64",
          "openSUSE Tumbleweed:apptainer-1.4.5-4.1.ppc64le",
          "openSUSE Tumbleweed:apptainer-1.4.5-4.1.s390x",
          "openSUSE Tumbleweed:apptainer-1.4.5-4.1.x86_64",
          "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.aarch64",
          "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.ppc64le",
          "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.s390x",
          "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.x86_64",
          "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.aarch64",
          "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.ppc64le",
          "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.s390x",
          "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.x86_64",
          "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.aarch64",
          "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.ppc64le",
          "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.s390x",
          "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-24137",
          "url": "https://www.suse.com/security/cve/CVE-2026-24137"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1257137 for CVE-2026-24137",
          "url": "https://bugzilla.suse.com/1257137"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-24137"
    },
    {
      "cve": "CVE-2026-33186",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33186"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apptainer-1.4.5-4.1.aarch64",
          "openSUSE Tumbleweed:apptainer-1.4.5-4.1.ppc64le",
          "openSUSE Tumbleweed:apptainer-1.4.5-4.1.s390x",
          "openSUSE Tumbleweed:apptainer-1.4.5-4.1.x86_64",
          "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.aarch64",
          "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.ppc64le",
          "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.s390x",
          "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.x86_64",
          "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.aarch64",
          "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.ppc64le",
          "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.s390x",
          "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.x86_64",
          "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.aarch64",
          "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.ppc64le",
          "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.s390x",
          "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33186",
          "url": "https://www.suse.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1260085 for CVE-2026-33186",
          "url": "https://bugzilla.suse.com/1260085"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33186"
    },
    {
      "cve": "CVE-2026-34986",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34986"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:apptainer-1.4.5-4.1.aarch64",
          "openSUSE Tumbleweed:apptainer-1.4.5-4.1.ppc64le",
          "openSUSE Tumbleweed:apptainer-1.4.5-4.1.s390x",
          "openSUSE Tumbleweed:apptainer-1.4.5-4.1.x86_64",
          "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.aarch64",
          "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.ppc64le",
          "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.s390x",
          "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.x86_64",
          "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.aarch64",
          "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.ppc64le",
          "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.s390x",
          "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.x86_64",
          "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.aarch64",
          "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.ppc64le",
          "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.s390x",
          "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34986",
          "url": "https://www.suse.com/security/cve/CVE-2026-34986"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262805 for CVE-2026-34986",
          "url": "https://bugzilla.suse.com/1262805"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-leap-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-sle15_7-1.4.5-4.1.x86_64",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.aarch64",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.ppc64le",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.s390x",
            "openSUSE Tumbleweed:apptainer-sle16-1.4.5-4.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-06T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34986"
    }
  ]
}

CVE-2026-34986 (GCVE-0-2026-34986)

Vulnerability from cvelistv5 – Published: 2026-04-06 16:22 – Updated: 2026-04-07 14:21

Title

Go JOSE affect by a panic in JWE decryption

Summary

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M

References

URL

Tags

	https://github.com/go-jose/go-jose/security/advis…	x_refsource_CONFIRM
	https://pkg.go.dev/github.com/go-jose/go-jose/v4#…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	go-jose	go-jose	Affected: >= 4.0.0, < 4.1.4 Affected: < 3.0.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34986",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T14:21:42.477191Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-07T14:21:54.041Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-jose",
          "vendor": "go-jose",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.1.4"
            },
            {
              "status": "affected",
              "version": "\u003c 3.0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-06T16:22:45.353Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
        },
        {
          "name": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
        }
      ],
      "source": {
        "advisory": "GHSA-78h2-9frx-2jm8",
        "discovery": "UNKNOWN"
      },
      "title": "Go JOSE affect by a panic in JWE decryption"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34986",
    "datePublished": "2026-04-06T16:22:45.353Z",
    "dateReserved": "2026-03-31T19:38:31.617Z",
    "dateUpdated": "2026-04-07T14:21:54.041Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24137 (GCVE-0-2026-24137)

Vulnerability from cvelistv5 – Published: 2026-01-23 00:04 – Updated: 2026-01-23 19:55

Title

sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal

Summary

sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.

Severity ?

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/sigstore/sigstore/security/adv…	x_refsource_CONFIRM
	https://github.com/sigstore/sigstore/commit/8ec41…	x_refsource_MISC
	https://github.com/sigstore/sigstore/releases/tag…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	sigstore	sigstore	Affected: < 1.10.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24137",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-23T19:55:31.439546Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-23T19:55:42.582Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "sigstore",
          "vendor": "sigstore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.10.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-23T00:04:19.046Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sigstore/sigstore/security/advisories/GHSA-fcv2-xgw5-pqxf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sigstore/sigstore/security/advisories/GHSA-fcv2-xgw5-pqxf"
        },
        {
          "name": "https://github.com/sigstore/sigstore/commit/8ec410a2993ea78083aecf0e473a85453039496e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/sigstore/commit/8ec410a2993ea78083aecf0e473a85453039496e"
        },
        {
          "name": "https://github.com/sigstore/sigstore/releases/tag/v1.10.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sigstore/sigstore/releases/tag/v1.10.4"
        }
      ],
      "source": {
        "advisory": "GHSA-fcv2-xgw5-pqxf",
        "discovery": "UNKNOWN"
      },
      "title": "sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-24137",
    "datePublished": "2026-01-23T00:04:19.046Z",
    "dateReserved": "2026-01-21T18:38:22.474Z",
    "dateUpdated": "2026-01-23T19:55:42.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-33186 (GCVE-0-2026-33186)

Vulnerability from cvelistv5 – Published: 2026-03-20 22:23 – Updated: 2026-03-24 18:09

Title

gRPC-Go has an authorization bypass via missing leading slash in :path

Summary

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Severity ?

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M

References

URL

Tags

https://github.com/grpc/grpc-go/security/advisori…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	grpc	grpc-go	Affected: < 1.79.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33186",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T18:08:38.989284Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-24T18:09:13.422Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "grpc-go",
          "vendor": "grpc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.79.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-20T22:23:32.147Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
        }
      ],
      "source": {
        "advisory": "GHSA-p77j-4mvh-x3m3",
        "discovery": "UNKNOWN"
      },
      "title": "gRPC-Go has an authorization bypass via missing leading slash in :path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33186",
    "datePublished": "2026-03-20T22:23:32.147Z",
    "dateReserved": "2026-03-17T22:16:36.720Z",
    "dateUpdated": "2026-03-24T18:09:13.422Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

OPENSUSE-SU-2026:10700-1

CVE-2026-34986 (GCVE-0-2026-34986)

CVE-2026-24137 (GCVE-0-2026-24137)

CVE-2026-33186 (GCVE-0-2026-33186)

Tags

Sightings

Nomenclature