CVE-2026-84303: gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Vulnerability summary

CVE-2026-84303 is a medium (CVSS 6.3) Improper Handling of Case Sensitivity vulnerability in grpc grpc-go. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 24% of scored vulnerabilities.

Timeline

1. 01-09-2026
   PublishedVulnerability first disclosed.
2. 02-09-2026
   Last modifiedVulnerability information updated.

Description

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.

• CWE-178Improper Handling of Case SensitivityThe product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.