CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,309; of 17,821 indexed, latest versions
Container images: 2,767; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,309 of 17,821 indexed charts deploy, on 2,767 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,763
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,309 by stars

Chart

Latest

Affected images

Radar Score

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.83.1

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

4,928

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.83.1

Open the chart page →

9,743

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,528

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,767 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
wernight/ngrok :latest	d211f29ebcfe	google.golang.org/grpc@v1.59.0	1.83.1	1
willnorris/imageproxy :latest	21d0c90f4c31	google.golang.org/grpc@v1.40.0	1.83.1	1
xosphere/xonodepools :1.0.7	1458097b6f85	google.golang.org/grpc@v1.72.2	1.83.1	1
zachomedia/cert-manager-webhook-pdns :v2.5.5	4940e227a39b	google.golang.org/grpc@v1.75.1	1.83.1	1
gcr.io/cadvisor/cadvisor :v0.40.0	135327c978de	google.golang.org/grpc@v1.33.2	1.83.1	1
gcr.io/cadvisor/cadvisor :v0.47.2	e6c562b5e983	google.golang.org/grpc@v1.51.0	1.83.1	1
gcr.io/cadvisor/cadvisor :v0.52.1	f40e65878e25	google.golang.org/grpc@v1.67.0	1.83.1	1
gcr.io/cloudsql-docker/gce-proxy :1.17	a85176b8e7cc	google.golang.org/grpc@v1.28.1	1.83.1	1
gcr.io/cockroachlabs-helm-charts/cockroach-self-signer-cert :1.3	e225fe7eaa55	google.golang.org/grpc@v1.29.1	1.83.1	1
gcr.io/datadoghq/cluster-agent :7.61.0	6efe04ba4e06	google.golang.org/grpc@v1.67.1	1.83.1	1
gcr.io/datadoghq/csi-driver :1.4.0	86c713de81d9	google.golang.org/grpc@v1.83.0	1.83.1	1
gcr.io/etcd-development/etcd :v3.7.1	a9983dd6d928	google.golang.org/grpc@v1.82.1	1.83.1	1
gcr.io/gke-release/custom-metrics-stackdriver-adapter :v0.13.1-gke.0	6937c0a9b203	google.golang.org/grpc@v1.38.0	1.83.1	1
gcr.io/gloo-mesh/gloo-mesh :1.1.2	a4011eae6a0b	google.golang.org/grpc@v1.37.0	1.83.1	1
gcr.io/google-samples/microservices-demo/cartservice :v0.2.3	566733b4d2d5	google.golang.org/grpc@v1.34.0	1.83.1	1
gcr.io/google-samples/microservices-demo/checkoutservice :v0.2.3	0fad1066de77	google.golang.org/grpc@v1.22.0	1.83.1	1
gcr.io/google-samples/microservices-demo/currencyservice :v0.2.3	49d458a3650f	google.golang.org/grpc@v1.34.0	1.83.1	1
gcr.io/google-samples/microservices-demo/frontend :v0.2.3	ca5c0f0771c8	google.golang.org/grpc@v1.22.0	1.83.1	1
gcr.io/google-samples/microservices-demo/paymentservice :v0.2.3	6eb201217a8f	google.golang.org/grpc@v1.34.0	1.83.1	1
gcr.io/google-samples/microservices-demo/productcatalogservice :v0.2.3	5a4a0e54c6d0	google.golang.org/grpc@v1.22.0	1.83.1	1
gcr.io/google-samples/microservices-demo/recommendationservice :v0.2.3	5f60c4988859	google.golang.org/grpc@v1.34.0	1.83.1	1
gcr.io/google-samples/microservices-demo/shippingservice :v0.2.3	0cb1707fc503	google.golang.org/grpc@v1.22.0	1.83.1	1
gcr.io/istio-release/pilot :1.11.1	c552478f8f11	google.golang.org/grpc@v1.39.0	1.83.1	1
gcr.io/istio-release/proxyv2 :1.11.1	9538fabe49fd	google.golang.org/grpc@v1.39.0	1.83.1	1
gcr.io/istio-testing/install-cni :latest	ec6f9ea5757b	google.golang.org/grpc@v1.82.1	1.83.1	1
gcr.io/istio-testing/operator :latest	8d4576f7b98f	google.golang.org/grpc@v1.65.0	1.83.1	1
gcr.io/k8s-staging-multitenancy/hnc-manager :v1.1.0	8ab8229f6a89	google.golang.org/grpc@v1.40.0	1.83.1	1
gcr.io/kaniko-project/executor :latest	4e7a52dd1f14	google.golang.org/grpc@v1.72.1	1.83.1	1
gcr.io/kasten-images/prometheus :9.0.5	da2bf307c353	google.golang.org/grpc@v1.82.1	1.83.1	1
gcr.io/kasten-images/restorectl :8.0.14	5a0884f9a90c	google.golang.org/grpc@v1.76.0	1.83.1	1
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/filter	d675f211a40f	google.golang.org/grpc@v1.67.1	1.83.1	1
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/ingress	ec4b544499ba	google.golang.org/grpc@v1.67.1	1.83.1	1
gcr.io/knative-releases/knative.dev/eventing/cmd/mtchannel_broker	395f4ff1bd34	google.golang.org/grpc@v1.67.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-certmanager/cmd/webhook	873b968f02b5	google.golang.org/grpc@v1.28.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller :v1.13.1	a5b041ba3c9e	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller	e70bc675f977	google.golang.org/grpc@v1.67.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller :v1.2.0	f253b82941c2	google.golang.org/grpc@v1.42.0	1.83.1	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook	7d76a6d42d13	google.golang.org/grpc@v1.67.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook :v1.2.0	a705c1ea8e9e	google.golang.org/grpc@v1.42.0	1.83.1	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook :v1.13.1	f066376eee17	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier	15a601147ef4	google.golang.org/grpc@v1.71.1	1.83.1	1
gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier	197fbb71d1f1	google.golang.org/grpc@v1.42.0	1.83.1	1
gcr.io/knative-releases/knative.dev/operator/cmd/operator :v1.22.3	733f21dc06f9	google.golang.org/grpc@v1.80.0	1.83.1	1
gcr.io/knative-releases/knative.dev/operator/cmd/webhook :v1.22.3	66ae76179a80	google.golang.org/grpc@v1.80.0	1.83.1	1
gcr.io/knative-releases/knative.dev/operator/cmd/webhook	6c5c90cdf707	google.golang.org/grpc@v1.47.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	08315309da4b	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	1e3db4f2eeed	google.golang.org/grpc@v1.33.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator :v1.13.1	21f8e11a44bf	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator :v1.2.5	93ff6e693577	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	a5de0fb75046	google.golang.org/grpc@v1.28.0	1.83.1	1