StackRadar

CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,232
of 17,803 indexed, latest versions
Container images
2,708
deployed by those charts
Fix available
1 of 2
affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,232 of 17,803 indexed charts deploy, on 2,708 images.

Affected packageAffected versionsFixed inImages
google.golang.org/grpcgolangv0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+114 more1.83.12,705
grpcdeb1.16.1-1ubuntu5, 1.51.1-4.1build5no fix listed3
OSV records
GHSA-qc2q-p7wx-3px3UBUNTU-CVE-2026-84303
Also known as
GO-2026-6441

Charts affected

2,232 by stars
ChartLatestAffected imagesRadar Score
kube-state-metricswenerme8.5.01 of 1See more

kube-state-metrics wenerme 8.5.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.042cfe3723a5f
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

89
longhornwenerme1.2.31 of 2See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.2.3dca34321452c
google.golang.org/grpc@v1.26.0
1.83.1

Open the chart page →

15,310
mesherywenerme1.0.701 of 1See more

meshery wenerme 1.0.70

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest44b64ee128fb
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

1,445
miniowenerme8.0.101 of 1See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2021-02-14T04-01-33Zbd11edda91f3
google.golang.org/grpc@v1.26.0
1.83.1

Open the chart page →

6,922
minio-standalonewenerme1.0.21 of 1See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
google.golang.org/grpc@v1.41.0
1.83.1

Open the chart page →

6,145
openebswenerme3.10.02 of 3See more

openebs wenerme 3.10.0

2 of the 3 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
openebs/node-disk-manager:2.1.0f6c18b0f8c8a
google.golang.org/grpc@v1.47.0
1.83.1
openebs/provisioner-localpv:3.5.0aea39e49bb97
google.golang.org/grpc@v1.55.0
1.83.1

Open the chart page →

10,602
prometheuswenerme29.30.12See more

prometheus wenerme 29.30.1

2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v3.14.05ce7540c3c00
google.golang.org/grpc@v1.82.1
1.83.1
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.042cfe3723a5f
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

rancherwenerme2.15.12 of 2See more

rancher wenerme 2.15.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.15f6c4dc52a05
google.golang.org/grpc@v1.79.3
1.83.1
rancher/shell:v0.8.1f293af9c635f
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

1,487
temporalwenerme0.15.14 of 13See more

temporal wenerme 0.15.1

4 of the 13 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:6.7.11ff3999e0fc0
google.golang.org/grpc@v1.23.1
1.83.1
prom/prometheus:v2.16.0e4ca62c0d62f
google.golang.org/grpc@v1.22.1
1.83.1
temporalio/admin-tools:1.15.135034611d981
google.golang.org/grpc@v1.44.0
1.83.1
temporalio/server:1.15.1e26758f5a1bf
google.golang.org/grpc@v1.44.0
1.83.1

Open the chart page →

22,707
traefikwenerme9.1.11 of 1See more

traefik wenerme 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
library/traefik:2.2.8f5af5a5ce17f
google.golang.org/grpc@v1.27.1
1.83.1

Open the chart page →

3,378
vaultwenerme0.34.11 of 2See more

vault wenerme 0.34.1

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
hashicorp/vault:2.0.45be49781ecf7
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

549
victoria-metrics-k8s-stackwenerme0.92.13 of 7See more

victoria-metrics-k8s-stack wenerme 0.92.1

3 of the 7 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:13.1.17cb8c64c4d57
google.golang.org/grpc@v1.81.1
1.83.1
victoriametrics/operator:v0.74.17310c4a80b94
google.golang.org/grpc@v1.82.1
1.83.1
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.185108987d044
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

1,915
victoria-metrics-operatorwenerme0.67.31 of 1See more

victoria-metrics-operator wenerme 0.67.3

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
victoriametrics/operator:v0.74.17310c4a80b94
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

115
wexa-studiowexa-studio1.2.05 of 15See more

wexa-studio wexa-studio 1.2.0

5 of the 15 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.40b01ed3924e6
google.golang.org/grpc@v1.58.3
1.83.1
minio/minio:RELEASE.2024-01-16T16-07-38Z4c4a4876193f
google.golang.org/grpc@v1.60.1
1.83.1
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
google.golang.org/grpc@v1.56.3
1.83.1
temporalio/server:1.29.1c1e3326b2ce1
google.golang.org/grpc@v1.72.2
1.83.1
temporalio/ui:2.44.00b36e00aad30
google.golang.org/grpc@v1.66.1
1.83.1

Open the chart page →

15,056
ceph-csi-cephfswikimedia0.1.85 of 5See more

ceph-csi-cephfs wikimedia 0.1.8

5 of the 5 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
gcr.io/k8s-staging-sig-storage/csi-provisioner:v3.2.14ad5fcdbe7e9
google.golang.org/grpc@v1.45.0
1.83.1
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
google.golang.org/grpc@v1.48.0
1.83.1
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.5.10103eee7c35e
google.golang.org/grpc@v1.40.0
1.83.1
registry.k8s.io/sig-storage/csi-resizer:v1.5.08f7520bd957e
google.golang.org/grpc@v1.40.0
1.83.1
registry.k8s.io/sig-storage/csi-snapshotter:v6.0.1ad16874e2140
google.golang.org/grpc@v1.40.0
1.83.1

Open the chart page →

10,321
ceph-csi-rbdwikimedia0.1.136 of 6See more

ceph-csi-rbd wikimedia 0.1.13

6 of the 6 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
gcr.io/k8s-staging-sig-storage/csi-provisioner:v3.2.14ad5fcdbe7e9
google.golang.org/grpc@v1.45.0
1.83.1
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
google.golang.org/grpc@v1.48.0
1.83.1
registry.k8s.io/sig-storage/csi-attacher:v3.5.0dd245051317e
google.golang.org/grpc@v1.40.0
1.83.1
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.5.10103eee7c35e
google.golang.org/grpc@v1.40.0
1.83.1
registry.k8s.io/sig-storage/csi-resizer:v1.5.08f7520bd957e
google.golang.org/grpc@v1.40.0
1.83.1
registry.k8s.io/sig-storage/csi-snapshotter:v6.0.1ad16874e2140
google.golang.org/grpc@v1.40.0
1.83.1

Open the chart page →

11,827
jaegerwikimedia3.1.23 of 4See more

jaeger wikimedia 3.1.2

3 of the 4 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
jaegertracing/jaeger-agent:1.53.00214a0ef24b1
google.golang.org/grpc@v1.60.0
1.83.1
jaegertracing/jaeger-collector:1.53.07f1269222903
google.golang.org/grpc@v1.60.0
1.83.1
jaegertracing/jaeger-query:1.53.0049bb0d64ea3
google.golang.org/grpc@v1.60.0
1.83.1

Open the chart page →

9,340
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
google.golang.org/grpc@v1.56.1
1.83.1

Open the chart page →

2,032
wireguardwireguard-bananas1.5.01 of 1See more

wireguard wireguard-bananas 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
place1/wg-access-server:v0.4.62b2f3ea80ed6
google.golang.org/grpc@v1.30.0
1.83.1

Open the chart page →

2,752
csi-driver-host-pathwiremindVerified publisher0.1.18 of 8See more

csi-driver-host-path wiremind 0.1.1

8 of the 8 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-attacher:v4.0.09a685020911e
google.golang.org/grpc@v1.47.0
1.83.1
registry.k8s.io/sig-storage/csi-external-health-monitor-controller:v0.7.080b9ba94aa2a
google.golang.org/grpc@v1.48.0
1.83.1
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.6.0f1c25991bac2
google.golang.org/grpc@v1.50.1
1.83.1
registry.k8s.io/sig-storage/csi-provisioner:v3.3.0ee3b525d5b89
google.golang.org/grpc@v1.49.0
1.83.1
registry.k8s.io/sig-storage/csi-resizer:v1.6.0425d8f1b7693
google.golang.org/grpc@v1.47.0
1.83.1
registry.k8s.io/sig-storage/csi-snapshotter:v6.1.0291334908ddf
google.golang.org/grpc@v1.47.0
1.83.1
registry.k8s.io/sig-storage/hostpathplugin:v1.9.092257881c1d6
google.golang.org/grpc@v1.34.0
1.83.1
registry.k8s.io/sig-storage/livenessprobe:v2.8.0cacee2b5c36d
google.golang.org/grpc@v1.48.0
1.83.1

Open the chart page →

12,663
orcwiremindVerified publisher0.3.01 of 1See more

orc wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/orc/openstack-resource-controller:v2.5.079f22af49612
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

269
registrywiremindVerified publisher0.1.11 of 1See more

registry wiremind 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
ghcr.io/distribution/distribution:3.0.04ba3adf47f5c
google.golang.org/grpc@v1.68.0
1.83.1

Open the chart page →

1,195
kafka-connect-uiwitcom-gmbh0.5.01 of 2See more

kafka-connect-ui witcom-gmbh 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/oauth2-proxy/oauth2-proxy:v7.3.08c21390be87d
google.golang.org/grpc@v1.27.0
1.83.1

Open the chart page →

2,512
mrtg-backendwitcom-gmbh0.7.01 of 2See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/oauth2-proxy/oauth2-proxy:v7.2.1febeebebe762
google.golang.org/grpc@v1.27.0
1.83.1

Open the chart page →

2,623
xboardxboard0.2.01 of 1See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
ghcr.io/cedar2025/xboard:latest896e4926e0d7
google.golang.org/grpc@v1.81.0
1.83.1

Open the chart page →

1,042
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
google.golang.org/grpc@v1.49.0
1.83.1

Open the chart page →

13,813
xonodepoolsxonodepoolsOfficialVerified publisher1.0.71 of 1See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
xosphere/xonodepools:1.0.71458097b6f85
google.golang.org/grpc@v1.72.2
1.83.1

Open the chart page →

394
ygdrassil-monitoringygdrassilVerified publisher0.4.02 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
google.golang.org/grpc@v1.69.2
1.83.1
quay.io/prometheus/prometheus:v3.1.06559acbd5d77
google.golang.org/grpc@v1.69.0
1.83.1

Open the chart page →

9,401
matrixdb-operatorymatrixOfficialVerified publisher0.13.01 of 2See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
matrixdb/kubebuilder_kube-rbac-proxy:v0.12.0ed3c7e6291e8
google.golang.org/grpc@v1.40.0
1.83.1

Open the chart page →

1,965
rawfile-csiymatrixVerified publisher0.2.14 of 4See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
matrixdb/custom-external-provisioner:4622a07d7-202204247e9ffe249a51
google.golang.org/grpc@v1.40.0
1.83.1
matrixdb/rawfile-csi:v0.2.195b2e38e913d
google.golang.org/grpc@v1.45.0
1.83.1
matrixdb/sig-storage_csi-node-driver-registrar:v2.2.0ba763bb01ddc
google.golang.org/grpc@v1.36.0
1.83.1
matrixdb/sig-storage_livenessprobe:v2.3.07ab06fe3d8a7
google.golang.org/grpc@v1.36.0
1.83.1

Open the chart page →

8,000
prometheus-monitoring-stackyotron-helm-charts1.2.03 of 3See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
google.golang.org/grpc@v1.81.1
1.83.1
quay.io/prometheus/alertmanager:latest690c7b525f43
google.golang.org/grpc@v1.82.1
1.83.1
quay.io/prometheus/prometheus:latest5ce7540c3c00
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

899
zahori-consulzahoriVerified publisher1.0.12 of 2See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
google.golang.org/grpc@v1.49.0
1.83.1
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
google.golang.org/grpc@v1.49.0
1.83.1

Open the chart page →

5,047

Container images carrying it

2,708 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
istio/install-cni:1.29.0ce27c9ce43c8
google.golang.org/grpc@v1.78.0
1.83.1
1
istio/operator:1.10.3655eefa11c84
google.golang.org/grpc@v1.36.0
1.83.1
1
istio/operator:1.12.06cfce8a071b9
google.golang.org/grpc@v1.42.0
1.83.1
1
istio/operator:1.18.270f9d1fe5fff
google.golang.org/grpc@v1.54.0
1.83.1
1
istio/pilot:1.10.0294ca55bd1cc
google.golang.org/grpc@v1.36.0
1.83.1
1
istio/pilot:1.29.0325156535773
google.golang.org/grpc@v1.78.0
1.83.1
1
istio/pilot:1.23.69c3d6a218181
google.golang.org/grpc@v1.65.0
1.83.1
1
istio/pilot:1.16.0ac0284d75ec9
google.golang.org/grpc@v1.49.0
1.83.1
1
istio/pilot:1.17.1ce9d87606701
google.golang.org/grpc@v1.52.3
1.83.1
1
istio/pilot:1.15.2db08d6963975
google.golang.org/grpc@v1.47.0
1.83.1
1
istio/pilot:1.10.3e7e110a421c2
google.golang.org/grpc@v1.36.0
1.83.1
1
istio/pilot:1.29.1f8b0e412ac4a
google.golang.org/grpc@v1.78.0
1.83.1
1
istio/proxyv2:1.9.687a9db561d2e
google.golang.org/grpc@v1.36.0
1.83.1
1
istio/proxyv2:1.10.088c6c693e67a
google.golang.org/grpc@v1.36.0
1.83.1
1
istio/proxyv2:1.14.1df69c1a7af7c
google.golang.org/grpc@v1.45.0
1.83.1
1
itzg/bungeecord:latest1c59f9631f3b
google.golang.org/grpc@v1.83.0
1.83.1
1
itzg/minecraft-server:latest8672e335dbef
google.golang.org/grpc@v1.83.0
1.83.1
1
itzg/minecraft-server:2026.9.1e8640538dac5
google.golang.org/grpc@v1.83.0
1.83.1
1
jaegertracing/all-in-one:1.2942822be7888b
google.golang.org/grpc@v1.41.0
1.83.1
1
jaegertracing/all-in-one:1.53.060e65bfffe1f
google.golang.org/grpc@v1.60.0
1.83.1
1
jaegertracing/all-in-one:1.42.07d32a4eddec7
google.golang.org/grpc@v1.52.1
1.83.1
1
jaegertracing/all-in-one:1.22.0ca6b73330616
google.golang.org/grpc@v1.29.1
1.83.1
1
jaegertracing/all-in-one:1.18db45c07f2e1b
google.golang.org/grpc@v1.27.1
1.83.1
1
jaegertracing/all-in-one:1.55f6b5d09073f1
google.golang.org/grpc@v1.62.0
1.83.1
1
jaegertracing/jaeger:2.20.046a886260e04
google.golang.org/grpc@v1.81.1
1.83.1
1
jaegertracing/jaeger:2.9.0e128b9adbb29
google.golang.org/grpc@v1.74.2
1.83.1
1
jaegertracing/jaeger:2.19.0ede4864215be
google.golang.org/grpc@v1.81.1
1.83.1
1
jaegertracing/jaeger-collector:1.41.0ff81f0a9f63c
google.golang.org/grpc@v1.51.0
1.83.1
1
jaegertracing/jaeger-query:1.41.0b636f0f464bc
google.golang.org/grpc@v1.51.0
1.83.1
1
jamesorlakin/cert-manager-cpanel-dns-webhook:v0.3.03894dc11b236
google.golang.org/grpc@v1.66.2
1.83.1
1
jhonbrownn/elchi-backend:v1.6.14-v0.14.0-envoy1.39.031aee9ba2c63
google.golang.org/grpc@v1.82.1
1.83.1
1
jhonbrownn/elchi-collector:v0.1.119fdd0724865e
google.golang.org/grpc@v1.80.0
1.83.1
1
jkremser/log2rbac:v0.0.5e35cf56ef183
google.golang.org/grpc@v1.45.0
1.83.1
1
jmferrer/azure-devops-agent:latest030f68ec6998
google.golang.org/grpc@v1.24.0
1.83.1
1
johnblack77/clustereye-api:latest9b8dbc0264ac
google.golang.org/grpc@v1.71.0
1.83.1
1
juicedata/csi-dashboard:v0.23.03e4daf9626d5
google.golang.org/grpc@v1.56.3
1.83.1
1
juicedata/csi-dashboard:v0.33.05e5edb62a010
google.golang.org/grpc@v1.82.1
1.83.1
1
juicedata/juicefs-csi-driver:v0.20.043978fc60798
google.golang.org/grpc@v1.48.0
1.83.1
1
juicedata/juicefs-csi-driver:v0.23.0d915e899e322
google.golang.org/grpc@v1.48.0
1.83.1
1
juicedata/juicefs-csi-driver:v0.33.0f918e7331c05
google.golang.org/grpc@v1.80.0
1.83.1
1
junktext/getting-started:1.0.5a70936c04aed
google.golang.org/grpc@v1.54.0
1.83.1
1
k8scloudprovider/cinder-csi-plugin:latesta30c7a2a594a
google.golang.org/grpc@v1.40.0
1.83.1
1
kazem26/liqo-upgrade-operator:v0.1268b7c6a59dd
google.golang.org/grpc@v1.72.1
1.83.1
1
keelhq/keel:0.19.202ac4ea616c4
google.golang.org/grpc@v1.54.0
1.83.1
1
kenchrcum/fluxcd-helm-upgrader:0.7.7c326e28a8f5f
google.golang.org/grpc@v1.72.1
1.83.1
1
keptncontrib/prometheus-service:0.6.029969dd547de
google.golang.org/grpc@v1.27.1
1.83.1
1
keyporttech/csi-driver-nfs:2.0.05bd7955ea2f1
google.golang.org/grpc@v1.20.0
1.83.1
1
kfirfer/gcloud-mysql:1.0.3c257c1e0e8b9
google.golang.org/grpc@v1.53.0
1.83.1
1
kfserving/kfserving-controller:v0.6.163d79d04c2e3
google.golang.org/grpc@v1.31.1
1.83.1
1
kiosksh/kiosk:0.2.11501725ba2025
google.golang.org/grpc@v1.27.1
1.83.1
1

syft 1.42.1 · advisories as of 17 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.