CVE-2026-84303 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
Attackers can bypass xDS RBAC HTTP filters in gRPC-Go by using mixed-case header names, allowing unauthorized access to protected resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84303?
CVE-2026-84303 is a medium-severity vulnerability in grpc-go, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.
Which versions are affected by CVE-2026-84303?
3 open source packages ship an affected version, including google.golang.org/grpc.
| Package | Affected | Fixed in |
|---|---|---|
google.golang.org/grpc Go | All versions | 1.83.1 |
google.golang.org/grpc Go | All versions | 1.83.1 |
google.golang.org/grpc Go | All versions | 1.83.1 |
Linux distribution packages (1)
v2ray-core openSUSE:Tumbleweed | All versions | 5.54.2-1.1 |
How do I fix CVE-2026-84303?
Upgrade google.golang.org/grpc to 1.83.1 or later.
Is CVE-2026-84303 being exploited?
There is no known exploitation of CVE-2026-84303 in the wild and no public exploit code.
Sources
Also known as AZL-99696, CLEANSTART-2026-CL66543, CLEANSTART-2026-DX35599, CLEANSTART-2026-DZ84628, CLEANSTART-2026-FQ72391, CLEANSTART-2026-HJ64426 and 1395 more.