CVE-2026-84303
MediumCVSS 6.3Summary
gRPC-Go prior to version 1.83.1 contains a vulnerability in the xDS RBAC HTTP filter where header matcher names are not lowercased even though incoming metadata keys are lowercase. A DENY policy using mixed-case names such as X-Role or User-Agent does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.
Risk Assessment
The organization may be exposed to unauthorized access to resources protected by RBAC policies, as requests that should be rejected may be allowed. Additionally, bypassing gRFC A41 validation could lead to message integrity violations.
Recommendation
It is recommended to immediately upgrade gRPC-Go to version 1.83.1 or later to eliminate the vulnerability.
Other vulnerabilities in gRPC-Go
See all- CVE-2026-84304High
gRPC-Go prior to 1.83.1 stores each fragmented HTTP/2 DATA frame as a separate recvMsg, so millions of one-byte frames can consume disproportionate heap memory. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or OOM termination. Receive-buffer compaction is enabled by default and can be controlled with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. Fixed in 1.83.1.
- GHSA-hrxh-6v49-42gfHigh
Multiple security vulnerabilities have been identified in the grpc-go library affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation. These vulnerabilities could lead to authorization bypass (Fail-Open) during rule translation.
- CVE-2026-33186Critical
A vulnerability in gRPC-Go before version 1.79.3 allows authorization bypass due to improper validation of the HTTP/2 `:path` pseudo-header. The server accepted requests with a missing leading slash (e.g., `Service/Method` instead of `/Service/Method`), causing deny rules based on canonical paths to be ineffective. An attacker can exploit this to bypass security policies if a fallback allow rule exists.
Original NVD description (English source)
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.