StackRadar

CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,252
of 17,803 indexed, latest versions
Container images
2,727
deployed by those charts
Fix available
1 of 2
affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,252 of 17,803 indexed charts deploy, on 2,727 images.

Affected packageAffected versionsFixed inImages
google.golang.org/grpcgolangv0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more1.83.12,723
grpcdeb1.16.1-1ubuntu5, 1.51.1-4.1build5no fix listed4
OSV records
GHSA-qc2q-p7wx-3px3UBUNTU-CVE-2026-84303
Also known as
GO-2026-6441

Charts affected

2,252 by stars
ChartLatestAffected imagesRadar Score
prometheus-monitoring-stackyotron-helm-charts1.2.03 of 3See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
google.golang.org/grpc@v1.81.1
1.83.1
quay.io/prometheus/alertmanager:latest690c7b525f43
google.golang.org/grpc@v1.82.1
1.83.1
quay.io/prometheus/prometheus:latest5ce7540c3c00
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

936
zahori-consulzahoriVerified publisher1.0.12 of 2See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
google.golang.org/grpc@v1.49.0
1.83.1
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
google.golang.org/grpc@v1.49.0
1.83.1

Open the chart page →

5,076

Container images carrying it

2,727 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/appscode/capi-ops-manager:v0.0.57465f35b684c
google.golang.org/grpc@v1.63.2
1.83.1
1
ghcr.io/appscode/cattleset:v0.0.145554a03e448
google.golang.org/grpc@v1.75.1
1.83.1
1
ghcr.io/appscode/cert-manager-webhook-ace:v0.0.2dc6b5fdcec06
google.golang.org/grpc@v1.75.1
1.83.1
1
ghcr.io/appscode/cluster-connector:v0.0.140efd9d9ef6ca
google.golang.org/grpc@v1.76.0
1.83.1
1
ghcr.io/appscode/cluster-presets:v0.0.128fbdd2479645
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/appscode/csi-driver-cacerts:v0.6.0ab213b156017
google.golang.org/grpc@v1.75.1
1.83.1
1
ghcr.io/appscode/docker-machine-operator:v0.0.481f6007abb4e
google.golang.org/grpc@v1.40.0
1.83.1
1
ghcr.io/appscode/external-dns-operator:v0.4.05605f97e636d
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/appscode/falco-ui-server:v0.0.66ec488d89b56
google.golang.org/grpc@v1.74.2
1.83.1
1
ghcr.io/appscode/fileserver:v0.0.2b1857871e06c
google.golang.org/grpc@v1.62.1
1.83.1
1
ghcr.io/appscode/gcp-credential-manager:v0.1.0b58345fe8209
google.golang.org/grpc@v1.76.0
1.83.1
1
ghcr.io/appscode/gh-ci-webhook:v0.0.2036ce246d884e
google.golang.org/grpc@v1.64.1
1.83.1
1
ghcr.io/appscode/grafana:v2025.2.367d18880448c
google.golang.org/grpc@v1.36.0
1.83.1
1
ghcr.io/appscode/inbox-agent:v0.0.66b99ee9feece
google.golang.org/grpc@v1.72.1
1.83.1
1
ghcr.io/appscode/kube-rbac-proxy:v0.18.27de54b6dedc8
google.golang.org/grpc@v1.65.0
1.83.1
1
ghcr.io/appscode/kube-rbac-proxy:v0.15.0d8cc6ffb9819
google.golang.org/grpc@v1.47.0
1.83.1
1
ghcr.io/appscode/kube-ui-server:v0.7.079e67164b4f0
google.golang.org/grpc@v1.80.0
1.83.1
1
ghcr.io/appscode/license-proxyserver:v0.0.8d6c2532ea386
google.golang.org/grpc@v1.59.0
1.83.1
1
ghcr.io/appscode/offline-license-server:v0.0.76e4b66308d8f6
google.golang.org/grpc@v1.72.1
1.83.1
1
ghcr.io/appscode/operator-shard-manager:v0.0.64a16c6ccecb8
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/appscode/panopticon:v0.0.243ea0e226a86d
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/appscode/petset:v0.2.0913f0858eb24
google.golang.org/grpc@v1.72.1
1.83.1
1
ghcr.io/appscode/pgoutbox:v0.0.4a96e06ec5e9f
google.golang.org/grpc@v1.66.2
1.83.1
1
ghcr.io/appscode/scanner:v0.0.2116907aae5de1
google.golang.org/grpc@v1.76.0
1.83.1
1
ghcr.io/appscode/secrets-store-csi-driver-provider-virtual-secrets:v0.2.07afb394f9f97
google.golang.org/grpc@v1.82.1
1.83.1
1
ghcr.io/appscode/sidekick:v0.0.16d8d2a3c22ee7
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/appscode/storage-metrics-server:v0.1.09cb4acb742a9
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/appscode/supervisor:v0.0.1223affde10a92
google.golang.org/grpc@v1.75.1
1.83.1
1
ghcr.io/appscode/taskqueue:v0.0.36877c958a3c6
google.golang.org/grpc@v1.72.1
1.83.1
1
ghcr.io/appscode/virtual-secrets-server:v0.4.0efa03f4c9551
google.golang.org/grpc@v1.82.1
1.83.1
1
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
google.golang.org/grpc@v1.55.0
1.83.1
1
ghcr.io/argelbargel/vault-raft-snapshot-agent:v0.12.5345174727a2b
google.golang.org/grpc@v1.65.0
1.83.1
1
ghcr.io/argonix-io/argonix-api:1.0.0aa679ddf5c3a
google.golang.org/grpc@v1.59.0
1.83.1
1
ghcr.io/arpa-network/node-client:latest657a2c9f6e6d
google.golang.org/grpc@v1.63.0
1.83.1
1
ghcr.io/aserto-dev/topaz:0.32.594c708ecf7dc4
google.golang.org/grpc@v1.71.1
1.83.1
1
ghcr.io/ashvinbambhaniya/nexus-tasks-backend:2.0.0f80349eb018b
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/astradns/astradns-agent:v0.2.9-unbound6ba69487f1b0
google.golang.org/grpc@v1.79.2
1.83.1
1
ghcr.io/astradns/astradns-operator:v0.2.909e58b62416a
google.golang.org/grpc@v1.72.2
1.83.1
1
ghcr.io/astriaorg/astria-indexer:0.1.05cf1e5709820
google.golang.org/grpc@v1.64.1
1.83.1
1
ghcr.io/astriaorg/astria-indexer-api:0.1.03490d9900af1
google.golang.org/grpc@v1.64.1
1.83.1
1
ghcr.io/astriaorg/flame:0.1.0c8af1c5aae40
google.golang.org/grpc@v1.64.1
1.83.1
1
ghcr.io/astriaorg/seq-faucet:0.9.0bf3cb9b505b6
google.golang.org/grpc@v1.64.1
1.83.1
1
ghcr.io/attestkeep/attestkeep-k8s:1.1.110ce4cac41c4
google.golang.org/grpc@v1.82.1
1.83.1
1
ghcr.io/aureq/cert-manager-webhook-ovh:0.9.160339cf9a75ca
google.golang.org/grpc@v1.83.0
1.83.1
1
ghcr.io/aureum-cloud/frp-operator:v1.0.196b01d7e7025
google.golang.org/grpc@v1.68.1
1.83.1
1
ghcr.io/automata-network/multi-prover-avs/operator:v0.6.0752f1aa02438
google.golang.org/grpc@v1.64.1
1.83.1
1
ghcr.io/axonops/axonops-operator:0.1.0e0cdb993f0b1
google.golang.org/grpc@v1.79.2
1.83.1
1
ghcr.io/b100to/idle-reaper:0.1.447b4a0e091f0
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/bank-vaults/bank-vaults:v1.33.198b6ea2ed319
google.golang.org/grpc@v1.81.1
1.83.1
1
ghcr.io/bank-vaults/vault-secrets-webhook:v1.23.198baf045a1c9
google.golang.org/grpc@v1.81.1
1.83.1
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.