Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-84303— gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Quick assessment

Affected
grpc grpc-go
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

gRPC-Go 是 gRPC 的 Go 语言实现。在 1.83.1 之前，位于 中的 xDS RBAC HTTP 过滤器在 函数中未将头部匹配器名称转换为小写，尽管接收到的元数据键本身均为小写。因此，使用混合大小写名称（如 或 ）的 DENY 策略无法正确匹配，导致“故障开放”（fail open），使得本应被拒绝的请求得以通过。同样的大小写不一致还允许 或 规避 gRFC A41 的验证，并阻止将 重写为 。该问题已在版本 1.83.1 中修复。

CVSS 6.3 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
grpc grpc-go < 1.83.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-84303

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
Source: CVE Program / CVE List V5
Vulnerability Description
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
grpc grpc-go < 1.83.1 -

II. Public POCs for CVE-2026-84303

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-84303

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-84303 (4)

Vendor Advisories for CVE-2026-84303 (1)

Vendor Pages for CVE-2026-84303 (1)

IV. Related Vulnerabilities

Same product: grpc-go
Same vendor: grpc
Same weakness: CWE-178

V. Comments for CVE-2026-84303

No comments yet

Leave a comment