CVE-2026-84303

Description

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.

CVSS Metrics

• v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
• v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Trends

Current EPSS score: 0.31%• Percentile: 24%

Techniques & Countermeasures

• CWE-178•Improper Handling of Case Sensitivity

  The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

• CWE-863•Incorrect Authorization

  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected Systems

• chainguard•amazon-cloudwatch-agent

  < 1.300073.0-r1

• chainguard•amazon-ssm-agent-ecs-exec-fips

  all | < 3.3.5226.0-r4

• chainguard•amazon-ssm-agent-fips

  all | < 3.3.5226.0-r4

• chainguard•argo-cd-3.1

  all

• chainguard•argo-cd-3.1-compat

  all

• chainguard•argo-cd-3.3-compat

  all

• chainguard•argo-cd-fips-3.1

  all

• chainguard•argo-cd-fips-3.1-compat

  all

• chainguard•argo-cd-fips-3.2

  all

• chainguard•argo-cd-fips-3.2-compat

  all

• chainguard•argo-workflow-controller-3.7

  all

• chainguard•argo-workflow-controller-fips-3.7

  all

• chainguard•argo-workflow-executor-3.7

  all

• chainguard•argo-workflow-executor-fips-3.7

  all

• chainguard•argo-workflows-3.7

  all

• chainguard•argo-workflows-fips-3.7

  all

• chainguard•auditbeat-fips-9.2

  all

• chainguard•aws-ebs-csi-driver-1.59

  all

• chainguard•aws-ebs-csi-driver-1.61

  all

• chainguard•aws-ebs-csi-driver-fips-1.55

  all

• chainguard•aws-ebs-csi-driver-fips-1.56

  all

• chainguard•aws-ebs-csi-driver-fips-1.61

  all

• chainguard•aws-ebs-csi-driver-fips-1.63

  all

• chainguard•aws-otel-collector

  all | < 0.50.0-r3

• chainguard•azurefile-csi-1.33

  all

• chainguard•bank-vaults-template

  < 1.33.2-r3

• chainguard•blob-csi-1.27

  < 1.27.10-r0

• chainguard•cadence

  all | < 0

• chainguard•cadence-cassandra-tool

  all | < 0

• chainguard•cadence-fips

  all | < 0

• chainguard•cadence-fips-cassandra-tool

  all | < 0

• chainguard•cadence-fips-server

  < 0

• chainguard•cadence-fips-sql-tool

  all | < 0

• chainguard•cadence-server

  < 0

• chainguard•cadence-sql-tool

  all | < 0

• chainguard•calico-apiserver-3.30

  all

• chainguard•calico-apiserver-fips-3.30

  all

• chainguard•calico-app-policy-3.30

  all

• chainguard•calico-app-policy-fips-3.30

  all

• chainguard•calico-cni-3.30

  all

• chainguard•calico-cni-fips-3.30

  all

• chainguard•calico-felix-3.30

  all

• chainguard•calico-felix-3.32

  < 3.32.2-r3

• chainguard•calico-felix-fips-3.30

  all

• chainguard•calico-goldmane-3.30

  all

• chainguard•calico-goldmane-3.31

  all | < 3.31.7-r3

• chainguard•calico-goldmane-3.32

  < 3.32.2-r3

• chainguard•calico-goldmane-fips-3.30

  all

• chainguard•calico-kube-controllers-3.30

  all

• chainguard•calico-kube-controllers-fips-3.30

  all

Showing first 50 affected entries in server-rendered view.

References (12)

• https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3
• https://github.com/grpc/grpc-go/pull/9332
• https://github.com/grpc/grpc-go/pull/9335
• https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8
• https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe
• https://github.com/grpc/grpc-go/releases/tag/v1.83.1
• https://security-tracker.debian.org/tracker/CVE-2026-84303
• https://ubuntu.com/security/CVE-2026-84303
• https://www.cve.org/CVERecord?id=CVE-2026-84303
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84303.json
• https://nvd.nist.gov/vuln/detail/CVE-2026-84303
• https://github.com/grpc/grpc-go