StackRadar

CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,252
of 17,803 indexed, latest versions
Container images
2,727
deployed by those charts
Fix available
1 of 2
affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,252 of 17,803 indexed charts deploy, on 2,727 images.

Affected packageAffected versionsFixed inImages
google.golang.org/grpcgolangv0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more1.83.12,723
grpcdeb1.16.1-1ubuntu5, 1.51.1-4.1build5no fix listed4
OSV records
GHSA-qc2q-p7wx-3px3UBUNTU-CVE-2026-84303
Also known as
GO-2026-6441

Charts affected

2,252 by stars
ChartLatestAffected imagesRadar Score
prometheus-monitoring-stackyotron-helm-charts1.2.03 of 3See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
google.golang.org/grpc@v1.81.1
1.83.1
quay.io/prometheus/alertmanager:latest690c7b525f43
google.golang.org/grpc@v1.82.1
1.83.1
quay.io/prometheus/prometheus:latest5ce7540c3c00
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

936
zahori-consulzahoriVerified publisher1.0.12 of 2See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
google.golang.org/grpc@v1.49.0
1.83.1
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
google.golang.org/grpc@v1.49.0
1.83.1

Open the chart page →

5,076

Container images carrying it

2,727 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
oryd/keto:v26.2.0bfdb8b9e283a
google.golang.org/grpc@v1.79.3
1.83.1
1
oryd/kratos:v26.2.02a13bb8d362c
google.golang.org/grpc@v1.79.3
1.83.1
1
oryd/kratos:v1.1.08f15006a080d
google.golang.org/grpc@v1.59.0
1.83.1
1
oryd/oathkeeper:v26.2.0467329abde34
google.golang.org/grpc@v1.79.3
1.83.1
1
otel/opentelemetry-collector:0.153.06ed874ea083d
google.golang.org/grpc@v1.81.1
1.83.1
1
otel/opentelemetry-collector:0.100.09e36620d6c2c
google.golang.org/grpc@v1.63.2
1.83.1
1
otel/opentelemetry-collector:0.59.0ee9da0b08d83
google.golang.org/grpc@v1.49.0
1.83.1
1
otel/opentelemetry-collector-contrib:0.114.037fa87091cfa
google.golang.org/grpc@v1.67.1
1.83.1
1
otel/opentelemetry-collector-contrib:0.143.03bc07732530c
google.golang.org/grpc@v1.78.0
1.83.1
1
otel/opentelemetry-collector-contrib:0.113.05ac3e0ba2b0b
google.golang.org/grpc@v1.67.1
1.83.1
1
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
google.golang.org/grpc@v1.57.0
1.83.1
1
otel/opentelemetry-collector-contrib:0.108.0923eb1cfae32
google.golang.org/grpc@v1.65.0
1.83.1
1
otel/opentelemetry-collector-contrib:0.89.0995f17004231
google.golang.org/grpc@v1.59.0
1.83.1
1
otel/opentelemetry-collector-contrib:0.145.0a7343f018690
google.golang.org/grpc@v1.78.0
1.83.1
1
otel/opentelemetry-collector-contrib:0.154.0b3079f45e19b
google.golang.org/grpc@v1.81.1
1.83.1
1
otel/opentelemetry-collector-contrib:0.46.0ba173aa85f3f
google.golang.org/grpc@v1.44.0
1.83.1
1
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
google.golang.org/grpc@v1.56.1
1.83.1
1
otel/opentelemetry-collector-contrib:0.63.1dfb3a55ea8c9
google.golang.org/grpc@v1.50.1
1.83.1
1
otel/opentelemetry-collector-contrib:0.157.0f2f01157055a
google.golang.org/grpc@v1.82.1
1.83.1
1
otel/opentelemetry-collector-contrib:0.139.0faf125d656fa
google.golang.org/grpc@v1.76.0
1.83.1
1
otel/opentelemetry-collector-k8s:0.120.01e45d9483faa
google.golang.org/grpc@v1.70.0
1.83.1
1
otel/opentelemetry-ebpf-k8s-watcher:v0.10.263a0d1dd2cac
google.golang.org/grpc@v1.53.0
1.83.1
1
owncloud/ocis:7.1.388e7c854517d
google.golang.org/grpc@v1.68.0
1.83.1
1
owncloud/ocis:8.0.1b38fd8fdd58f
google.golang.org/grpc@v1.78.0
1.83.1
1
owncloud/ocis:1.7.0d2efcae92c84
google.golang.org/grpc@v1.38.0
1.83.1
1
owncloud/server:10.15.051d9b74fc2a8
google.golang.org/grpc@v1.64.0
1.83.1
1
owncloud/server:10.16.274c53d341076
google.golang.org/grpc@v1.80.0
1.83.1
1
owncloud/server:10.16.3b3f9efdcd7f7
google.golang.org/grpc@v1.81.1
1.83.1
1
percona/mongodb_exporter:0.53.00214e482b2cd
google.golang.org/grpc@v1.82.1
1.83.1
1
percona/percona-postgresql-operator:2.8.06cce2698d3f5
google.golang.org/grpc@v1.76.0
1.83.1
1
percona/percona-server-mongodb-operator:1.23.0feaff989e253
google.golang.org/grpc@v1.82.1
1.83.1
1
percona/percona-xtradb-cluster-operator:1.20.0ac4d0995c71e
google.golang.org/grpc@v1.81.1
1.83.1
1
percona/pmm-server:3.9.1003f9c25f842
google.golang.org/grpc@v1.83.0
1.83.1
1
persesdev/perses:v0.54.0a0e34ddaf9d7
google.golang.org/grpc@v1.82.1
1.83.1
1
pgsharding/spqr-router:nightly-2.8.3-1839-f66048d84734940216d3
google.golang.org/grpc@v1.77.0
1.83.1
1
phntom/chartmuseum:v0.16.053883b65d9b7
google.golang.org/grpc@v1.55.0
1.83.1
1
phntom/chartmuseum:v0.15.29242b4df9e65
google.golang.org/grpc@v1.47.0
1.83.1
1
phntom/mattermost-team-edition:9.3.051cf9da4aa2e
google.golang.org/grpc@v1.56.1
1.83.1
1
phntom/oauth2-proxy:v7.3.48ea656a2a895
google.golang.org/grpc@v1.27.0
1.83.1
1
pinclr/v2ray-proxy:latestf37f250b7091
google.golang.org/grpc@v1.53.0
1.83.1
1
pipekit13/agent:v8.0.1b969a930b439
google.golang.org/grpc@v1.82.1
1.83.1
1
platzio/backend:v0.6.5d5e5972f344b
google.golang.org/grpc@v1.68.1
1.83.1
1
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
google.golang.org/grpc@v1.24.0
1.83.1
1
pnnlmiscscripts/tenant-namespace-operator:0.1.24-18af4b7551d40
google.golang.org/grpc@v1.53.0
1.83.1
1
pomerium/pomerium:v0.22.19c69b10a2126
google.golang.org/grpc@v1.54.0
1.83.1
1
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
google.golang.org/grpc@v1.49.0
1.83.1
1
portainer/portainer-ce:2.45.0511f3f06c96f
google.golang.org/grpc@v1.82.1
1.83.1
1
posit/package-manager:2026.09.0-ubuntu-24.04527493ef621b
google.golang.org/grpc@v1.82.1
1.83.1
1
pozetroninc/liftbridge:v1.1.079fd6b9d93e6
google.golang.org/grpc@v1.24.0
1.83.1
1
pritunl/pritunl-zero:1.0.3648.460f2943e0d41b
google.golang.org/grpc@v1.60.1
1.83.1
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.