OESA-2026-1887

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-1887
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-1887.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2026-1887
Upstream
Published
2026-04-11T14:05:16Z
Modified
2026-04-11T14:18:50.010345Z
Summary
kata-containers security update
Details

This is core component of Kata Container, to make it work, you need a isulad/docker engine.

Security Fix(es):

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx); AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.(CVE-2026-33186)

Database specific 
{
    "severity": "Critical"
}
References

Affected packages

openEuler:20.03-LTS-SP4
kata-containers

Package

Name
kata-containers
Purl
pkg:rpm/openEuler/kata-containers&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
v1.11.1-20.oe2003sp4

Ecosystem specific 

{
    "src": [
        "kata-containers-v1.11.1-20.oe2003sp4.src.rpm"
    ],
    "x86_64": [
        "kata-containers-v1.11.1-20.oe2003sp4.x86_64.rpm"
    ],
    "aarch64": [
        "kata-containers-v1.11.1-20.oe2003sp4.aarch64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1887.json"
openEuler:22.03-LTS-SP4
kata-containers

Package

Name
kata-containers
Purl
pkg:rpm/openEuler/kata-containers&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.11.1-34.oe2203sp4

Ecosystem specific 

{
    "src": [
        "kata-containers-1.11.1-34.oe2203sp4.src.rpm"
    ],
    "x86_64": [
        "kata-containers-1.11.1-34.oe2203sp4.x86_64.rpm"
    ],
    "aarch64": [
        "kata-containers-1.11.1-34.oe2203sp4.aarch64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1887.json"
openEuler:24.03-LTS
kata-containers

Package

Name
kata-containers
Purl
pkg:rpm/openEuler/kata-containers&distro=openEuler-24.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.0-18.oe2403sp3

Ecosystem specific 

{
    "src": [
        "kata-containers-3.2.0-17.oe2403.src.rpm",
        "kata-containers-3.2.0-18.oe2403sp1.src.rpm",
        "kata-containers-3.2.0-18.oe2403sp2.src.rpm",
        "kata-containers-3.2.0-18.oe2403sp3.src.rpm"
    ],
    "x86_64": [
        "kata-containers-3.2.0-17.oe2403.x86_64.rpm",
        "kata-containers-3.2.0-18.oe2403sp1.x86_64.rpm",
        "kata-containers-3.2.0-18.oe2403sp2.x86_64.rpm",
        "kata-containers-3.2.0-18.oe2403sp3.x86_64.rpm"
    ],
    "aarch64": [
        "kata-containers-3.2.0-17.oe2403.aarch64.rpm",
        "kata-containers-3.2.0-18.oe2403sp1.aarch64.rpm",
        "kata-containers-3.2.0-18.oe2403sp2.aarch64.rpm",
        "kata-containers-3.2.0-18.oe2403sp3.aarch64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1887.json"
openEuler:24.03-LTS-SP1
kata-containers

Package

Name
kata-containers
Purl
pkg:rpm/openEuler/kata-containers&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.0-18.oe2403sp1

Ecosystem specific 

{
    "src": [
        "kata-containers-3.2.0-18.oe2403sp1.src.rpm"
    ],
    "x86_64": [
        "kata-containers-3.2.0-18.oe2403sp1.x86_64.rpm"
    ],
    "aarch64": [
        "kata-containers-3.2.0-18.oe2403sp1.aarch64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1887.json"
openEuler:24.03-LTS-SP2
kata-containers

Package

Name
kata-containers
Purl
pkg:rpm/openEuler/kata-containers&distro=openEuler-24.03-LTS-SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.0-18.oe2403sp2

Ecosystem specific 

{
    "src": [
        "kata-containers-3.2.0-18.oe2403sp2.src.rpm"
    ],
    "x86_64": [
        "kata-containers-3.2.0-18.oe2403sp2.x86_64.rpm"
    ],
    "aarch64": [
        "kata-containers-3.2.0-18.oe2403sp2.aarch64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1887.json"
openEuler:24.03-LTS-SP3
kata-containers

Package

Name
kata-containers
Purl
pkg:rpm/openEuler/kata-containers&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.0-18.oe2403sp3

Ecosystem specific 

{
    "src": [
        "kata-containers-3.2.0-18.oe2403sp3.src.rpm"
    ],
    "x86_64": [
        "kata-containers-3.2.0-18.oe2403sp3.x86_64.rpm"
    ],
    "aarch64": [
        "kata-containers-3.2.0-18.oe2403sp3.aarch64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-1887.json"