CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,252; of 17,803 indexed, latest versions
Container images: 2,727; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,252 of 17,803 indexed charts deploy, on 2,727 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,723
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,252 by stars

Chart

Latest

Affected images

Radar Score

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,076

Container images carrying it

2,727 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
gcr.io/google-samples/microservices-demo/cartservice :v0.2.3	566733b4d2d5	google.golang.org/grpc@v1.34.0	1.83.1	1
gcr.io/google-samples/microservices-demo/checkoutservice :v0.2.3	0fad1066de77	google.golang.org/grpc@v1.22.0	1.83.1	1
gcr.io/google-samples/microservices-demo/currencyservice :v0.2.3	49d458a3650f	google.golang.org/grpc@v1.34.0	1.83.1	1
gcr.io/google-samples/microservices-demo/frontend :v0.2.3	ca5c0f0771c8	google.golang.org/grpc@v1.22.0	1.83.1	1
gcr.io/google-samples/microservices-demo/paymentservice :v0.2.3	6eb201217a8f	google.golang.org/grpc@v1.34.0	1.83.1	1
gcr.io/google-samples/microservices-demo/productcatalogservice :v0.2.3	5a4a0e54c6d0	google.golang.org/grpc@v1.22.0	1.83.1	1
gcr.io/google-samples/microservices-demo/recommendationservice :v0.2.3	5f60c4988859	google.golang.org/grpc@v1.34.0	1.83.1	1
gcr.io/google-samples/microservices-demo/shippingservice :v0.2.3	0cb1707fc503	google.golang.org/grpc@v1.22.0	1.83.1	1
gcr.io/istio-release/pilot :1.11.1	c552478f8f11	google.golang.org/grpc@v1.39.0	1.83.1	1
gcr.io/istio-release/proxyv2 :1.11.1	9538fabe49fd	google.golang.org/grpc@v1.39.0	1.83.1	1
gcr.io/istio-testing/install-cni :latest	ec6f9ea5757b	google.golang.org/grpc@v1.82.1	1.83.1	1
gcr.io/istio-testing/operator :latest	8d4576f7b98f	google.golang.org/grpc@v1.65.0	1.83.1	1
gcr.io/k8s-staging-multitenancy/hnc-manager :v1.1.0	8ab8229f6a89	google.golang.org/grpc@v1.40.0	1.83.1	1
gcr.io/kaniko-project/executor :latest	4e7a52dd1f14	google.golang.org/grpc@v1.72.1	1.83.1	1
gcr.io/kasten-images/prometheus :9.0.5	da2bf307c353	google.golang.org/grpc@v1.82.1	1.83.1	1
gcr.io/kasten-images/restorectl :8.0.14	5a0884f9a90c	google.golang.org/grpc@v1.76.0	1.83.1	1
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/filter	d675f211a40f	google.golang.org/grpc@v1.67.1	1.83.1	1
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/ingress	ec4b544499ba	google.golang.org/grpc@v1.67.1	1.83.1	1
gcr.io/knative-releases/knative.dev/eventing/cmd/mtchannel_broker	395f4ff1bd34	google.golang.org/grpc@v1.67.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-certmanager/cmd/webhook	873b968f02b5	google.golang.org/grpc@v1.28.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller :v1.13.1	a5b041ba3c9e	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller	e70bc675f977	google.golang.org/grpc@v1.67.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller :v1.2.0	f253b82941c2	google.golang.org/grpc@v1.42.0	1.83.1	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook	7d76a6d42d13	google.golang.org/grpc@v1.67.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook :v1.2.0	a705c1ea8e9e	google.golang.org/grpc@v1.42.0	1.83.1	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook :v1.13.1	f066376eee17	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier	15a601147ef4	google.golang.org/grpc@v1.71.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier	197fbb71d1f1	google.golang.org/grpc@v1.42.0	1.83.1	1
gcr.io/knative-releases/knative.dev/operator/cmd/operator :v1.22.3	733f21dc06f9	google.golang.org/grpc@v1.80.0	1.83.1	1
gcr.io/knative-releases/knative.dev/operator/cmd/webhook :v1.22.3	66ae76179a80	google.golang.org/grpc@v1.80.0	1.83.1	1
gcr.io/knative-releases/knative.dev/operator/cmd/webhook	6c5c90cdf707	google.golang.org/grpc@v1.47.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	08315309da4b	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	1e3db4f2eeed	google.golang.org/grpc@v1.33.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator :v1.13.1	21f8e11a44bf	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator :v1.2.5	93ff6e693577	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	a5de0fb75046	google.golang.org/grpc@v1.28.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator :v1.10.2	c2994c2b6c2c	google.golang.org/grpc@v1.48.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler :v1.2.5	007820fdb75b	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	105bdd14ecaa	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	2ef460356b17	google.golang.org/grpc@v1.28.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler :v1.13.1	34796e9f760b	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler :v1.10.2	8319aa662b49	google.golang.org/grpc@v1.48.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	db6ceff2aab4	google.golang.org/grpc@v1.33.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler-hpa :v1.10.2	eb612b929eaa	google.golang.org/grpc@v1.48.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	30ce73388ae5	google.golang.org/grpc@v1.28.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.13.1	53d9aa4d2c7a	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.2.5	75cfdcfa050a	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.10.2	98a2cc7fd62e	google.golang.org/grpc@v1.48.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	b2cd45b8a8a4	google.golang.org/grpc@v1.33.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	bac158dfb0c7	google.golang.org/grpc@v1.44.0	1.83.1	1