CVE-2026-84303 with a CVSS score of 6.3 is a vulnerability affecting google.golang.org/grpc versions <= 1.83.0 in the xDS RBAC HTTP filter implementation in grpc-go that allows remote attackers to bypass authorization policies by using mixed-case or canonical-case header matchers, and gRFC A41 validation evasion, specifically DENY rules can be evaded via variations in casing; an operator defines an RBAC policy referencing headers containing uppercase letters, grpc-go fails to match incoming metadata keys because they are unconditionally lowercased, resulting in a policy designed to block requests containing specific header values failing open, and traffic that should have been rejected is served, additionally gRFC A41 requires rejecting configuration schemas specifying header matchers starting with grpc-, but this check is executed case-sensitively in grpc-go, attackers can bypass the validation by specifying titles like Grpc-Status; this vulnerability has a significant business impact as it allows unauthorized access to sensitive data and potentially disrupts critical services, particularly in the Technology & IT sector.
We recommend you to update grpc-go to version 1.83.1.[/subscribe_to_unlock_form]
CVE-2026-84303 with a CVSS score of 6.3 is a vulnerability affecting google.golang.org/grpc versions <= 1.83.0 in the xDS RBAC HTTP filter implementation in grpc-go that allows remote attackers to bypass authorization policies by using mixed-case or canonical-case header matchers, and gRFC A41 validation evasion, specifically DENY rules can be evaded via variations in casing; an operator defines an RBAC policy referencing headers containing uppercase letters, grpc-go fails to match incoming metadata keys because they are unconditionally lowercased, resulting in a policy designed to block requests containing specific header values failing open, and traffic that should have been rejected is served, additionally gRFC A41 requires rejecting configuration schemas specifying header matchers starting with grpc-, but this check is executed case-sensitively in grpc-go, attackers can bypass the validation by specifying titles like Grpc-Status; this vulnerability has a significant business impact as it allows unauthorized access to sensitive data and potentially disrupts critical services, particularly in the Technology & IT sector.
We recommend you to update grpc-go to version 1.83.1.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]