CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,309; of 17,821 indexed, latest versions
Container images: 2,767; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,309 of 17,821 indexed charts deploy, on 2,767 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,763
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,309 by stars

Chart

Latest

Affected images

Radar Score

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.83.1

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

4,928

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.83.1

Open the chart page →

9,743

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,528

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,767 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
grafana/grafana :12.2.0	74144189b384	google.golang.org/grpc@v1.74.2	1.83.1	1
grafana/grafana :9.4.3	76dcf36e7d2a	google.golang.org/grpc@v1.45.0	1.83.1	1
grafana/grafana :10.3.3	8640e5038e83	google.golang.org/grpc@v1.60.1	1.83.1	1
grafana/grafana :11.5.2	8b37a2f028f1	google.golang.org/grpc@v1.69.2	1.83.1	1
grafana/grafana :9.1.1	9746858c20e6	google.golang.org/grpc@v1.45.0	1.83.1	1
grafana/grafana :12.1.1	a1701c218024	google.golang.org/grpc@v1.73.0	1.83.1	1
grafana/grafana :9.0.1	a738d0744784	google.golang.org/grpc@v1.45.0	1.83.1	1
grafana/grafana :10.4.19	a9043254ba16	google.golang.org/grpc@v1.71.0	1.83.1	1
grafana/grafana :13.1.3	ab5cb380e3ff	google.golang.org/grpc@v1.82.1	1.83.1	1
grafana/grafana :11.1.3	b23b588cf7cb	google.golang.org/grpc@v1.64.0	1.83.1	1
grafana/grafana :12.0.2	b5b59bfc7561	google.golang.org/grpc@v1.72.1	1.83.1	1
grafana/grafana :8.1.5	b7dd9cd0e59d	google.golang.org/grpc@v1.39.0	1.83.1	1
grafana/grafana :12.3.2	ba93c9d192e5	google.golang.org/grpc@v1.77.0	1.83.1	1
grafana/grafana :6.5.1	befcd84da2c1	google.golang.org/grpc@v1.23.1	1.83.1	1
grafana/grafana :8.3.5	cd7cb4345aa7	google.golang.org/grpc@v1.41.0	1.83.1	1
grafana/grafana :8.3.4	cf81d2c753c8	google.golang.org/grpc@v1.41.0	1.83.1	1
grafana/grafana :7.4.5	d322192ed2fa	google.golang.org/grpc@v1.35.0	1.83.1	1
grafana/grafana :9.3.6	e5a9655dabef	google.golang.org/grpc@v1.45.0	1.83.1	1
grafana/grafana :8.5.3	ecc1b80b8ca2	google.golang.org/grpc@v1.42.0	1.83.1	1
grafana/grafana :10.4.0	f9811e4e687f	google.golang.org/grpc@v1.60.1	1.83.1	1
grafana/grafana :11.3.1	fa801ab6e1ae	google.golang.org/grpc@v1.66.0	1.83.1	1
grafana/logcli :main-c90366d-amd64	3d85bb66e39b	google.golang.org/grpc@v1.37.0	1.83.1	1
grafana/loki :2.9.10	35b02acc6765	google.golang.org/grpc@v1.56.3	1.83.1	1
grafana/loki :2.9.2	6074e01dbe03	google.golang.org/grpc@v1.56.3	1.83.1	1
grafana/loki :2.9.6	6ca6e2cd3b6f	google.golang.org/grpc@v1.56.3	1.83.1	1
grafana/loki :3.0.0	757b5fadf816	google.golang.org/grpc@v1.62.1	1.83.1	1
grafana/loki :2.0.0	77e138f81a8e	google.golang.org/grpc@v1.29.1	1.83.1	1
grafana/loki :3.7.4	87f0a0676737	google.golang.org/grpc@v1.81.1	1.83.1	1
grafana/loki :3.2.0	882e30c20683	google.golang.org/grpc@v1.65.0	1.83.1	1
grafana/loki :3.3.2	8af2de1abbdd	google.golang.org/grpc@v1.67.1	1.83.1	1
grafana/loki :3.6.1	92bd5700577b	google.golang.org/grpc@v1.75.1	1.83.1	1
grafana/loki :2.8.2	b1da1d23037e	google.golang.org/grpc@v1.52.3	1.83.1	1
grafana/loki :2.4.2	b3af8ead67d7	google.golang.org/grpc@v1.40.0	1.83.1	1
grafana/loki :3.6.3	cd6e176883a9	google.golang.org/grpc@v1.75.1	1.83.1	1
grafana/loki :3.7.6	efd47c67f9ba	google.golang.org/grpc@v1.82.1	1.83.1	1
grafana/loki-canary :3.6.12	1e9bfcff3867	google.golang.org/grpc@v1.81.1	1.83.1	1
grafana/loki-canary :3.0.0	28d7c00588aa	google.golang.org/grpc@v1.62.1	1.83.1	1
grafana/loki-canary :3.1.0	39baf6d67f85	google.golang.org/grpc@v1.62.1	1.83.1	1
grafana/loki-canary :2.9.2	4249db29b992	google.golang.org/grpc@v1.56.3	1.83.1	1
grafana/loki-canary :3.2.0	49e03f80d361	google.golang.org/grpc@v1.65.0	1.83.1	1
grafana/loki-canary :2.9.6	549a40203e97	google.golang.org/grpc@v1.56.3	1.83.1	1
grafana/loki-canary :2.6.1	ab2a2569307b	google.golang.org/grpc@v1.44.0	1.83.1	1
grafana/loki-canary :3.6.5	fbb984bab741	google.golang.org/grpc@v1.75.1	1.83.1	1
grafana/mcp-grafana :1.5.1	07c6614a8f8b	google.golang.org/grpc@v1.80.0	1.83.1	1
grafana/mcp-grafana :0.14.0	42f541f22063	google.golang.org/grpc@v1.80.0	1.83.1	1
grafana/mimir :r292-5f01872	7476e456c738	google.golang.org/grpc@v1.63.2	1.83.1	1
grafana/mimir :2.0.0	80c1a8eb24dd	google.golang.org/grpc@v1.41.1	1.83.1	1
grafana/mimir :2.15.0	85f55510e0d3	google.golang.org/grpc@v1.65.0	1.83.1	1
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	google.golang.org/grpc@v1.75.0	1.83.1	1
grafana/phlare :0.5.1	330f990cdad9	google.golang.org/grpc@v1.44.0	1.83.1	1