p PatchFirst

CVE-2026-84303

CVE-2026-84303 · gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.

CVSS 6.3 · Medium · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • grpc-go

    Versions
    • < 1.83.1: Affected

    No fix published

  • golang-google-grpc Debian:12

    Versions
    • 1.33.3-2
    • 1.38.0+really1.33.3-1
    • 1.38.0-1
    • 1.38.0-2
    • 1.38.0-3
    • 1.38.0-4
    • 1.38.0-5
    • 1.38.1-1
    • 1.59.0-1
    • 1.60.1-1
    • 1.60.1-2
    • 1.64.0-1
    • 1.64.0-2
    • 1.64.0-3
    • 1.64.0-4
    • 1.64.0-5
    • 1.64.0-6
    • 1.64.0-7
    • 1.66.3-1
    • 1.66.3-2
    • 1.75.1-1
    • 1.79.3-1
    • 1.79.3-1~bpo13+1
    • 1.81.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Debian:13

    Versions
    • 1.64.0-7
    • 1.66.3-1
    • 1.66.3-2
    • 1.75.1-1
    • 1.79.3-1
    • 1.79.3-1~bpo13+1
    • 1.81.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Debian:14

    Versions
    • 1.64.0-7
    • 1.66.3-1
    • 1.66.3-2
    • 1.75.1-1
    • 1.79.3-1
    • 1.79.3-1~bpo13+1
    • 1.81.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:16.04:LTS

    Versions
    • 0.0~git20150514.0.f5ebd86-1
    • 0.0~git20150514.0.f5ebd86-2
    • 0.0~git20151002.0.3e7b7e5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:Pro:16.04:LTS

    Versions
    • 20201217.02-0ubuntu1~16.04.0
    • 20230426.00-0ubuntu2~16.04.3
    • 20231004.02-0ubuntu1~16.04.1
    • 20231004.02-0ubuntu1~16.04.2
    • 20240716.00-0ubuntu1~16.04.0
    • 20240716.00-0ubuntu1~16.04.0+esm1
    • 20240716.00-0ubuntu1~16.04.0+esm2
    • 20240716.00-0ubuntu1~16.04.0+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:16.04:LTS

    Versions
    • 0.10.2-1
    • 0.11.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:18.04:LTS

    Versions
    • 1.0.4-1
    • 1.6.0-2
    • 1.6.0-3
    • 1.6.0-3ubuntu0.18.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:Pro:18.04:LTS

    Versions
    • 20201217.02-0ubuntu1~18.04.0
    • 20210414.00-0ubuntu1~18.04.0
    • 20210629.00-0ubuntu1~18.04.1
    • 20220622.00-0ubuntu2~18.04.0
    • 20220622.00-0ubuntu2~18.04.1
    • 20230426.00-0ubuntu2~18.04.0
    • 20231004.02-0ubuntu1~18.04.2
    • 20231004.02-0ubuntu1~18.04.3
    • 20240716.00-0ubuntu1~18.04.0
    • 20241011.01-0ubuntu1~18.04.0
    • 20241011.01-0ubuntu1~18.04.0+esm1
    • 20241011.01-0ubuntu1~18.04.0+esm2
    • 20241011.01-0ubuntu1~18.04.0+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:18.04:LTS

    Versions
    • 1.3.2-1
    • 1.3.2-1ubuntu1
    • 1.3.2-1.1~build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:Pro:20.04:LTS

    Versions
    • 20201217.02-0ubuntu1~20.04.0
    • 20210414.00-0ubuntu1~20.04.0
    • 20210629.00-0ubuntu1~20.04.0
    • 20220622.00-0ubuntu2~20.04.0
    • 20220622.00-0ubuntu2~20.04.2
    • 20230426.00-0ubuntu2~20.04.0
    • 20231004.02-0ubuntu1~20.04.1
    • 20231004.02-0ubuntu1~20.04.2
    • 20231004.02-0ubuntu1~20.04.3
    • 20231004.02-0ubuntu1~20.04.4
    • 20240716.00-0ubuntu1~20.04.0
    • 20241011.01-0ubuntu1~20.04.1
    • 20250116.00-0ubuntu1~20.04.0
    • 20250116.00-0ubuntu1~20.04.0+esm1
    • 20250116.00-0ubuntu1~20.04.0+esm2
    • 20250116.00-0ubuntu1~20.04.0+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:20.04:LTS

    Versions
    • 1.22.1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:20.04:LTS

    Versions
    • 1.16.1-1
    • 1.16.1-1ubuntu1
    • 1.16.1-1ubuntu3
    • 1.16.1-1ubuntu4
    • 1.16.1-1ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:22.04:LTS

    Versions
    • 1.29.1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:22.04:LTS

    Versions
    • 20210629.00-0ubuntu1
    • 20210629.00-0ubuntu2
    • 20220104.00-0ubuntu1
    • 20220104.00-0ubuntu2
    • 20220622.00-0ubuntu2~22.04.0
    • 20220622.00-0ubuntu2~22.04.1
    • 20230426.00-0ubuntu2~22.04.0
    • 20231004.02-0ubuntu1~22.04.1
    • 20231004.02-0ubuntu1~22.04.2
    • 20231004.02-0ubuntu1~22.04.3
    • 20231004.02-0ubuntu1~22.04.4
    • 20231004.02-0ubuntu1~22.04.5
    • 20240716.00-0ubuntu1~22.04.0
    • 20241011.01-0ubuntu1~22.04.0
    • 20250116.00-0ubuntu1~22.04.0
    • 20250116.00-0ubuntu1~22.04.1
    • 20250116.00-0ubuntu1~22.04.2
    • 20250116.00-0ubuntu1~22.04.3
    • 20250116.00-0ubuntu1~22.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:22.04:LTS

    Versions
    • 1.30.2-3
    • 1.30.2-3build1
    • 1.30.2-3build3
    • 1.30.2-3build5
    • 1.30.2-3build6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:24.04:LTS

    Versions
    • 20230426.00-0ubuntu3
    • 20231004.02-0ubuntu1
    • 20231004.02-0ubuntu3
    • 20240213.00-0ubuntu1
    • 20240213.00-0ubuntu2
    • 20240213.00-0ubuntu3
    • 20240213.00-0ubuntu3.1
    • 20240213.00-0ubuntu3.2
    • 20240716.00-0ubuntu1~24.04.0
    • 20240716.00-0ubuntu1~24.04.1
    • 20241011.01-0ubuntu1~24.04.0
    • 20250116.00-0ubuntu1~24.04.0
    • 20250116.00-0ubuntu1~24.04.1
    • 20250116.00-0ubuntu1~24.04.2
    • 20250116.00-0ubuntu1~24.04.3
    • 20250116.00-0ubuntu1~24.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:24.04:LTS

    Versions
    • 1.51.1-3build3
    • 1.51.1-3build4
    • 1.51.1-4
    • 1.51.1-4build1
    • 1.51.1-4build2
    • 1.51.1-4.1build3
    • 1.51.1-4.1build4
    • 1.51.1-4.1build5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:Pro:24.04:LTS

    Versions
    • 1.38.0+really1.33.3-1build1
    • 1.38.0+really1.33.3-1ubuntu0.24.04.1
    • 1.38.0+really1.33.3-1ubuntu0.24.04.2
    • 1.38.0+really1.33.3-1ubuntu0.24.04.2+esm1
    • 1.38.0+really1.33.3-1ubuntu0.24.04.3
    • 1.38.0+really1.33.3-1ubuntu0.24.04.3+esm1
    • 1.38.0+really1.33.3-1ubuntu0.24.04.3+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:26.10

    Versions
    • 1.66.3-2
    • 1.81.1-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:26.10

    Versions
    • 20250506.01-0ubuntu2
    • 20250506.01-0ubuntu3
    • 20260819.00+~20260819.00-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:26.10

    Versions
    • 1.51.1-8ubuntu1
    • 1.51.1-9
    • 1.51.1-9ubuntu3
    • 1.51.1-10ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:26.04:LTS

    Versions
    • 1.64.0-7
    • 1.66.3-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:26.04:LTS

    Versions
    • 20250506.01-0ubuntu1
    • 20250506.01-0ubuntu2
    • 20250506.01-0ubuntu2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →