gRPC-Go xDS RBAC Filter Vulnerability in Version Prior to 1.83.1
CVE-2026-84303

6.3MEDIUM

Key Information:

Vendor

Grpc

Status
Grpc-go
Vendor
CVE Published:
1 September 2026

What is CVE-2026-84303?

A vulnerability in gRPC-Go's implementation prior to version 1.83.1 allows improper header matching due to case sensitivity errors. The xDS RBAC HTTP filter fails to convert header matcher names to lowercase when normalizing, leading to situations where DENY policies using mixed-case names can unintentionally permit requests that should be blocked. This flaw also enables critical metadata like :Scheme or Grpc-Status to bypass gRFC A41 validation, compromising the integrity of request handling and potentially allowing unauthorized access. This issue was resolved in version 1.83.1.

Affected Version(s)

grpc-go < 1.83.1

References

https://github.com/grpc/grpc-go/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/grpc/grpc-go/pull/9332
x_refsource_MISC
https://github.com/grpc/grpc-go/pull/9335
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.