[High] Patch prometheus-adapter for CVE-2026-33186

[Akhila Guruju (akhila-guruju)]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

Patch prometheus-adapter for CVE-2026-33186

Change Log

• new file: SPECS/prometheus-adapter/CVE-2026-33186.patch
• modified: SPECS/prometheus-adapter/prometheus-adapter.spec

Does this affect the toolchain?

NO

Associated issues

• #xxxx

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-33186

Test Methodology

• Local Build

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Akhila Guruju (akhila-guruju)]

Patch Analysis:
Backported: Yes

Backports upstream grpc/grpc-go@72186f1 to the vendored grpc-go v1.60.1 in prometheus-adapter 0.12.0.

Fix: the server previously accepted requests whose :path omitted the leading / (e.g. Service/Method), which could bypass path-based authorization "deny" rules. With this patch, non-canonical paths are rejected with Unimplemented. An escape hatch (GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING=true) restores the old behavior for compatibility.

Only internal/envconfig/envconfig.go and server.go files are present in azl source code.

Adapted to v1.60.1 API (upstream targets v1.79.3):

• handleMalformedMethodName() takes t transport.ServerTransport, stream *transport.Stream (no transport.ServerStream in this version).
• Uses t.WriteStatus(stream, ...) instead of stream.WriteStatus(...).
• Uses the s.channelzID field instead of s.channelz.

[Akhila Guruju (akhila-guruju)]

Buddy Build has passed and patch applies cleanly.

[jslobodzian]

Spec review clean (patches referenced + applied, changelog version/release match). PR-check build succeeded with pTests passing on AMD64 and ARM64. Approved.

[azurelinux-ci-jwt-app]

Auto cherry-pick results:

• 3.0-dev ❌ -> [AUTO-CHERRYPICK] [High] Patch prometheus-adapter for CVE-2026-33186 - branch 3.0-dev #18431
  -> Failed. Please see the logs for more information

Auto cherry-pick pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1182731&view=results

[azurelinux-ci-jwt-app]

Auto cherry-pick results:

• 3.0-dev ✅ -> Skipped

Auto cherry-pick pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1182731&view=results