CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,309; of 17,821 indexed, latest versions
Container images: 2,767; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,309 of 17,821 indexed charts deploy, on 2,767 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,763
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,309 by stars

Chart

Latest

Affected images

Radar Score

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.83.1

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

4,928

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.83.1

Open the chart page →

9,743

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,528

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,767 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
openkruise/kruise-manager :v1.9.1	f81ae78a36a4	google.golang.org/grpc@v1.65.0	1.83.1	1
openmined/syft-seaweedfs :0.9.5	3a4144c0bb82	google.golang.org/grpc@v1.61.1	1.83.1	1
opennms/sentinel :36.0.2	88869082a14f	google.golang.org/grpc@v1.67.0	1.83.1	1
openpolicyagent/gatekeeper :v3.17.1	b7b4d7cfdd52	google.golang.org/grpc@v1.65.0	1.83.1	1
openpolicyagent/gatekeeper :v3.23.1	dfc6fc78753f	google.golang.org/grpc@v1.82.1	1.83.1	1
openpolicyagent/opa :0.53.1	6a58dea59933	google.golang.org/grpc@v1.55.0	1.83.1	1
openpolicyagent/opa :1.19.0	852359995443	google.golang.org/grpc@v1.82.1	1.83.1	1
opensearchproject/opensearch-operator :3.0.0-alpha	f78bbdd1a386	google.golang.org/grpc@v1.68.1	1.83.1	1
opentext/verticadb-operator :26.2.2-0	4ad44e44476c	google.golang.org/grpc@v1.82.1	1.83.1	1
opsgenie/kubernetes-event-exporter :0.9	ecb246e4d260	google.golang.org/grpc@v1.29.1	1.83.1	1
optimizely/agent :4.0.0	9d0096cabd63	google.golang.org/grpc@v1.59.0	1.83.1	1
orbitalreg/orbitalreg-api :0.1.0	45f2620337af	google.golang.org/grpc@v1.65.0	1.83.1	1
oryd/hydra :v2.3.0	b94007e19a1f	google.golang.org/grpc@v1.67.1	1.83.1	1
oryd/hydra :v26.2.0	ff67c7fb5f95	google.golang.org/grpc@v1.79.3	1.83.1	1
oryd/keto :v26.2.0	bfdb8b9e283a	google.golang.org/grpc@v1.79.3	1.83.1	1
oryd/kratos :v26.2.0	2a13bb8d362c	google.golang.org/grpc@v1.79.3	1.83.1	1
oryd/kratos :v1.1.0	8f15006a080d	google.golang.org/grpc@v1.59.0	1.83.1	1
oryd/oathkeeper :v26.2.0	467329abde34	google.golang.org/grpc@v1.79.3	1.83.1	1
otel/opentelemetry-collector :0.153.0	6ed874ea083d	google.golang.org/grpc@v1.81.1	1.83.1	1
otel/opentelemetry-collector :0.100.0	9e36620d6c2c	google.golang.org/grpc@v1.63.2	1.83.1	1
otel/opentelemetry-collector :0.59.0	ee9da0b08d83	google.golang.org/grpc@v1.49.0	1.83.1	1
otel/opentelemetry-collector-contrib :0.156.0	125bdbeb7590	google.golang.org/grpc@v1.82.0	1.83.1	1
otel/opentelemetry-collector-contrib :0.128.0	1ab0baba0ee3	google.golang.org/grpc@v1.72.2	1.83.1	1
otel/opentelemetry-collector-contrib :0.114.0	37fa87091cfa	google.golang.org/grpc@v1.67.1	1.83.1	1
otel/opentelemetry-collector-contrib :0.143.0	3bc07732530c	google.golang.org/grpc@v1.78.0	1.83.1	1
otel/opentelemetry-collector-contrib :0.113.0	5ac3e0ba2b0b	google.golang.org/grpc@v1.67.1	1.83.1	1
otel/opentelemetry-collector-contrib :0.83.0	71fcef33ae71	google.golang.org/grpc@v1.57.0	1.83.1	1
otel/opentelemetry-collector-contrib :0.108.0	923eb1cfae32	google.golang.org/grpc@v1.65.0	1.83.1	1
otel/opentelemetry-collector-contrib :0.89.0	995f17004231	google.golang.org/grpc@v1.59.0	1.83.1	1
otel/opentelemetry-collector-contrib :0.154.0	b3079f45e19b	google.golang.org/grpc@v1.81.1	1.83.1	1
otel/opentelemetry-collector-contrib :0.46.0	ba173aa85f3f	google.golang.org/grpc@v1.44.0	1.83.1	1
otel/opentelemetry-collector-contrib :0.81.0	c6671841470b	google.golang.org/grpc@v1.56.1	1.83.1	1
otel/opentelemetry-collector-contrib :0.63.1	dfb3a55ea8c9	google.golang.org/grpc@v1.50.1	1.83.1	1
otel/opentelemetry-collector-contrib :0.157.0	f2f01157055a	google.golang.org/grpc@v1.82.1	1.83.1	1
otel/opentelemetry-collector-contrib :0.139.0	faf125d656fa	google.golang.org/grpc@v1.76.0	1.83.1	1
otel/opentelemetry-collector-k8s :0.120.0	1e45d9483faa	google.golang.org/grpc@v1.70.0	1.83.1	1
otel/opentelemetry-ebpf-k8s-watcher :v0.10.2	63a0d1dd2cac	google.golang.org/grpc@v1.53.0	1.83.1	1
owncloud/ocis :7.1.3	88e7c854517d	google.golang.org/grpc@v1.68.0	1.83.1	1
owncloud/ocis :8.0.1	b38fd8fdd58f	google.golang.org/grpc@v1.78.0	1.83.1	1
owncloud/ocis :1.7.0	d2efcae92c84	google.golang.org/grpc@v1.38.0	1.83.1	1
owncloud/server :10.15.0	51d9b74fc2a8	google.golang.org/grpc@v1.64.0	1.83.1	1
owncloud/server :10.16.2	74c53d341076	google.golang.org/grpc@v1.80.0	1.83.1	1
owncloud/server :10.16.3	b3f9efdcd7f7	google.golang.org/grpc@v1.81.1	1.83.1	1
percona/mongodb_exporter :0.53.0	0214e482b2cd	google.golang.org/grpc@v1.82.1	1.83.1	1
percona/percona-postgresql-operator :2.8.0	6cce2698d3f5	google.golang.org/grpc@v1.76.0	1.83.1	1
percona/percona-server-mongodb-operator :1.23.0	feaff989e253	google.golang.org/grpc@v1.82.1	1.83.1	1
percona/percona-xtradb-cluster-operator :1.20.0	ac4d0995c71e	google.golang.org/grpc@v1.81.1	1.83.1	1
percona/pmm-server :3.9.1	003f9c25f842	google.golang.org/grpc@v1.83.0	1.83.1	1
persesdev/perses :v0.54.0	a0e34ddaf9d7	google.golang.org/grpc@v1.82.1	1.83.1	1
pgsharding/spqr-router :nightly-2.8.3-1839-f66048d8	4734940216d3	google.golang.org/grpc@v1.77.0	1.83.1	1