CVE-2026-84303
published 2026-09-01CVE-2026-84303: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header…
PriorityP340medium6.3CVSS 4.0
AVNACLATPPRNUINVCLVILVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.31%
23.7th percentile
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| google.golang.org | grpc | >= 0 < 1.83.1 | 1.83.1 |
| grpc | grpc-go | < 1.83.1 | 1.83.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
ghsa·2026-09-08
CVE-2026-84303 [MEDIUM] CWE-178 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
### Summary
A vulnerability in the xDS RBAC HTTP filter implementation in grpc-go allows remote attackers to bypass authorization policies (specifically DENY rules) by using mixed-case or canonical-case header matchers (e.g., X-Role instead of x-role). Additionally, the safety guards introduced by gRFC A41 to block grpc- prefixed headers can be evaded via variations in casing (e.g., Grpc-Status).
### Impact
When an operator defines an RBAC policy referencing headers containing uppercase letters (e.g. X-Role), grpc-go fails to match incoming metadata keys because they are unconditionally lowercased. Because of this case-sensitivity mismatch, a policy designed to block requests containing sp
VulDB
grpc gRPC-Go up to 1.83.0 xDS RBAC HTTP Filter rbac.go normalizeHeaderMatcher access control (Nessus ID 342303)
vuldb·2026-09-03·CVSS 6.3
CVE-2026-84303 [MEDIUM] grpc gRPC-Go up to 1.83.0 xDS RBAC HTTP Filter rbac.go normalizeHeaderMatcher access control (Nessus ID 342303)
A vulnerability described as critical has been identified in grpc gRPC-Go up to 1.83.0. Affected by this issue is the function normalizeHeaderMatcher of the file internal/xds/httpfilter/rbac/rbac.go of the component xDS RBAC HTTP Filter. The manipulation results in improper access controls.
This vulnerability is cataloged as CVE-2026-84303. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fehttps://github.com/grpc/grpc-go/pull/9332https://github.com/grpc/grpc-go/pull/9335https://github.com/grpc/grpc-go/releases/tag/v1.83.1https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3
2026-09-01
Published