StackRadar

CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,276
of 17,828 indexed, latest versions
Container images
2,733
deployed by those charts
Fix available
1 of 2
affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,276 of 17,828 indexed charts deploy, on 2,733 images.

Affected packageAffected versionsFixed inImages
google.golang.org/grpcgolangv0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more1.83.12,730
grpcdeb1.16.1-1ubuntu5, 1.51.1-4.1build5no fix listed3
OSV records
GHSA-qc2q-p7wx-3px3UBUNTU-CVE-2026-84303
Also known as
GO-2026-6441

Charts affected

2,276 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

2,733 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
dragonflyoss/scheduler:v2.5.2d5dea9e662cd
google.golang.org/grpc@v1.80.0
1.83.1
1
drone/drone:2.28.255897c8fb22d
google.golang.org/grpc@v1.59.0
1.83.1
1
drone/drone-runner-docker:1.8.1137e79c5e23c
google.golang.org/grpc@v1.29.1
1.83.1
1
drumsergio/duplicacy-container:0.1.0dd3ee9703969
google.golang.org/grpc@v1.28.1
1.83.1
1
dtzar/helm-kubectl:3.11.2a1041bb0f1d1
google.golang.org/grpc@v1.49.0
1.83.1
1
dutchcoders/transfer.sh:v1.6.1-noroot8db9ade72a0d
google.golang.org/grpc@v1.56.3
1.83.1
1
dysnix/gke-upgrade-notification-handler:latestc166f958f86a
google.golang.org/grpc@v1.40.0
1.83.1
1
ebrianne/cert-manager-webhook-duckdns:v1.2.39cd17700c9ec
google.golang.org/grpc@v1.27.0
1.83.1
1
eginnovations/agent:7.5.4e4dfe242fe9f
google.golang.org/grpc@v1.80.0
1.83.1
1
eginnovations/universal-agent-operator:0.0.11b8e3e26dca1b
google.golang.org/grpc@v1.68.1
1.83.1
1
elastic/apm-server:7.17.6c7a1c63257d0
google.golang.org/grpc@v1.48.0
1.83.1
1
elastiflow/flow-collector:7.26.0fee67842e16b
google.golang.org/grpc@v1.81.0
1.83.1
1
electriccoinco/lightwalletd:v0.5.42ae3a551e111
google.golang.org/grpc@v1.82.1
1.83.1
1
emirozbir/dashdns-controller:v2.0.5d3a5c1063425
google.golang.org/grpc@v1.68.1
1.83.1
1
emqx/ecp-main:2.5.1fa876f71e5d6
google.golang.org/grpc@v1.67.1
1.83.1
1
emqxecp/otelcol:2.5.04c31d9bec846
google.golang.org/grpc@v1.66.0
1.83.1
1
enix/san-iscsi-csi:v4.0.2f963da81ecf7
google.golang.org/grpc@v1.31.0
1.83.1
1
envoyproxy/ai-gateway-controller:003ab39f36923b5d40609a601e2951b73f6318fbec1f06ee29a7
google.golang.org/grpc@v1.74.2
1.83.1
1
envoyproxy/gateway:v0.5.02a9f99d28567
google.golang.org/grpc@v1.56.2
1.83.1
1
envoyproxy/ratelimit:a90e0e5d5966cbc14d5d
google.golang.org/grpc@v1.65.0
1.83.1
1
envoyproxy/ratelimit:v1.4.071081616da3e
google.golang.org/grpc@v1.19.0
1.83.1
1
envoyproxy/ratelimit:6f5de117b6cb6e16f8c9
google.golang.org/grpc@v1.27.0
1.83.1
1
envoyproxy/ratelimit:4d2efd61ede09a75a84c
google.golang.org/grpc@v1.27.0
1.83.1
1
epamedp/edp-headlamp:0.25.093417e18bb1a
google.golang.org/grpc@v1.60.1
1.83.1
1
epamedp/edp-tekton:0.2.4924939850655
google.golang.org/grpc@v1.50.1
1.83.1
1
epamedp/keycloak-operator:1.35.0a5398eaa7b80
google.golang.org/grpc@v1.79.3
1.83.1
1
epamedp/nexus-operator:3.6.09fede333ef27
google.golang.org/grpc@v1.82.1
1.83.1
1
epamedp/sonar-operator:3.4.0661d1648a49a
google.golang.org/grpc@v1.82.1
1.83.1
1
epamedp/tekton-custom-task:0.2.067d896676f45
google.golang.org/grpc@v1.70.0
1.83.1
1
erigontech/erigon:v2.61.288706754b627
google.golang.org/grpc@v1.63.2
1.83.1
1
ethereum/client-go:stableb8ab3451a117
google.golang.org/grpc@v1.79.1
1.83.1
1
ethpandaops/cbt-api:latest9dc0b50e6c27
google.golang.org/grpc@v1.80.0
1.83.1
1
ethpandaops/clickhouse-movoor:latestc0e6cc6542c1
google.golang.org/grpc@v1.81.1
1.83.1
1
ethpandaops/contributoor:latest1edd4074fd79
google.golang.org/grpc@v1.80.0
1.83.1
1
ethpandaops/forky:debian-latestc937f4ba737c
google.golang.org/grpc@v1.72.1
1.83.1
1
ethpandaops/rpc-snooper:latestc0b30fcf64bc
google.golang.org/grpc@v1.74.2
1.83.1
1
ethpandaops/xatu-cbt-api:latestf7dec2e07091
google.golang.org/grpc@v1.76.0
1.83.1
1
evcc/evcc:0.300.8ddf2a25afce5
google.golang.org/grpc@v1.78.0
1.83.1
1
factly/mande-server:0.34.1384d384310ef
google.golang.org/grpc@v1.50.1
1.83.1
1
falcosecurity/falco-operator:0.4.18a99fcc57a57
google.golang.org/grpc@v1.79.3
1.83.1
1
falcosecurity/falcosidekick:2.32.01976da721518
google.golang.org/grpc@v1.75.0
1.83.1
1
falcosecurity/falcosidekick:2.27.0828ee36cb13a
google.golang.org/grpc@v1.49.0
1.83.1
1
farmer1992/sshpiperd:v1.5.4e0064b824403
google.golang.org/grpc@v1.81.1
1.83.1
1
fatliverfreddy/cyphernetes-operator:lateste79f24ca7371
google.golang.org/grpc@v1.67.3
1.83.1
1
flanksource/apm-hub:v0.0.471dacc3195bf9
google.golang.org/grpc@v1.55.0
1.83.1
1
flanksource/batch-runner:v1.0.44689687a7cf95
google.golang.org/grpc@v1.71.1
1.83.1
1
flanksource/vcluster-sync-host-secrets:v0.1.6bd3294c20a60
google.golang.org/grpc@v1.40.0
1.83.1
1
fleetdm/fleet:v4.66.012e644b7f40e
google.golang.org/grpc@v1.67.1
1.83.1
1
flomesh/fsm-manager:0.2.1122f849c70b25
google.golang.org/grpc@v1.49.0
1.83.1
1
flomesh/osm-edge-bootstrap:1.3.9b188e128cbfe
google.golang.org/grpc@v1.51.0
1.83.1
1

syft 1.42.1 · advisories as of 21 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.