Medium severityNVD Advisory· Published Sep 1, 2026· Updated Sep 9, 2026
CVE-2026-84303
CVE-2026-84303
Description
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
google.golang.org/grpcGo | < 1.83.1 | 1.83.1 |
Affected products
30- osv-coords29 versionspkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/apptainer&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/v2ray-core&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/apptainer&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/kubevirt1.9&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/amazon-ecs-init&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/google-osconfig-agent&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/mcphost&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/hauler&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/cadvisor&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/hauler&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/containerized-data-importer1.66&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/v2ray-core&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/google-cloud-sap-agent&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/google-osconfig-agent&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/alloy&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/distribution&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/distribution&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/trivy&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/helm&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/google-guest-agent&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/mcphost&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/cadvisor&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/grafana&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/helm3&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/trivy&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/containerized-data-importer1.65&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/helm&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/containerized-data-importer1.65&distro=openSUSE%20Leap%2016.0
< 0.0.20260916T180043-160000.1.1+ 28 more
- (no CPE)range: < 0.0.20260916T180043-160000.1.1
- (no CPE)range: < 1.5.3-4.1
- (no CPE)range: < 5.54.2-1.1
- (no CPE)range: < 1.5.3-bp160.4.1
- (no CPE)range: < 1.9.0-3.1
- (no CPE)range: < 1.107.0-160000.1.1
- (no CPE)range: < 20260908.00-1.1
- (no CPE)range: < 0.34.0-11.1
- (no CPE)range: < 2.1.0-bp160.3.1
- (no CPE)range: < 0.60.5-3.1
- (no CPE)range: < 2.1.0-3.1
- (no CPE)range: < 1.66.1-1.1
- (no CPE)range: < 5.54.2-bp160.1.1
- (no CPE)range: < 3.15-160000.4.1
- (no CPE)range: < 20260911.00-160000.1.1
- (no CPE)range: < 1.20.1-1.1
- (no CPE)range: < 3.1.1-160000.3.1
- (no CPE)range: < 3.1.1-6.1
- (no CPE)range: < 0.74.0-160000.2.1
- (no CPE)range: < 3.21.3-160000.2.1
- (no CPE)range: < 20260903.01-160000.1.1
- (no CPE)range: < 0.34.0-160000.5.1
- (no CPE)range: < 0.60.5-bp160.2.1
- (no CPE)range: < 12.4.11-1.1
- (no CPE)range: < 3.21.3-8.1
- (no CPE)range: < 0.74.0-4.1
- (no CPE)range: < 1.65.0-3.1
- (no CPE)range: < 4.2.4-3.1
- (no CPE)range: < 1.65.0-160000.3.1
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-qc2q-p7wx-3px3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-84303ghsaADVISORY
- github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8nvdWEB
- github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fenvdWEB
- github.com/grpc/grpc-go/pull/9332nvdWEB
- github.com/grpc/grpc-go/pull/9335nvdWEB
- github.com/grpc/grpc-go/releases/tag/v1.83.1nvdWEB
- github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3nvdWEB
News mentions
0No linked articles in our index yet.