CVE-2026-84303
Received Received - Intake

Authorization Bypass in gRPC-Go via Case-Insensitive Header Matching

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84303
EUVD
EUVD-2026-69419

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
grpc grpc-go 1.83.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in gRPC-Go affects the xDS RBAC HTTP filter. It fails to lowercase header matcher names during matching, causing case-sensitive mismatches. For example, a DENY policy using X-Role or User-Agent does not match lowercase metadata keys, allowing unauthorized requests. The issue also permits bypassing gRFC A41 validation for headers like :Scheme or Grpc-Status and prevents Host from being rewritten to :authority.

Detection Guidance

To detect this vulnerability, check the version of gRPC-Go installed on your system. Run: go list -m google.golang.org/grpc. If the version is below 1.83.1, the system is vulnerable. Additionally, review RBAC policies for mixed-case header matchers like X-Role or User-Agent, as these may indicate misconfigured policies that fail open.

Impact Analysis

This vulnerability allows unauthorized access to gRPC services by bypassing RBAC DENY policies. Attackers can craft requests with mixed-case headers (e.g., X-Role) to evade access controls. It also enables bypassing validation rules for grpc- prefixed headers and prevents proper Host header rewriting, potentially exposing sensitive data or services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information). Improper access controls may result in data breaches, non-compliance with access control policies, and failure to meet regulatory standards for data security and privacy.

Mitigation Strategies

Upgrade gRPC-Go to version 1.83.1 or later immediately. This can be done using: go get google.golang.org/grpc@latest. After upgrading, review and correct any RBAC policies to ensure header matchers use lowercase names and comply with gRFC A41 validation rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84303. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart