StackRadar

CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,252
of 17,803 indexed, latest versions
Container images
2,727
deployed by those charts
Fix available
1 of 2
affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,252 of 17,803 indexed charts deploy, on 2,727 images.

Affected packageAffected versionsFixed inImages
google.golang.org/grpcgolangv0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more1.83.12,723
grpcdeb1.16.1-1ubuntu5, 1.51.1-4.1build5no fix listed4
OSV records
GHSA-qc2q-p7wx-3px3UBUNTU-CVE-2026-84303
Also known as
GO-2026-6441

Charts affected

2,252 by stars
ChartLatestAffected imagesRadar Score
prometheus-monitoring-stackyotron-helm-charts1.2.03 of 3See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
google.golang.org/grpc@v1.81.1
1.83.1
quay.io/prometheus/alertmanager:latest690c7b525f43
google.golang.org/grpc@v1.82.1
1.83.1
quay.io/prometheus/prometheus:latest5ce7540c3c00
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

936
zahori-consulzahoriVerified publisher1.0.12 of 2See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
google.golang.org/grpc@v1.49.0
1.83.1
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
google.golang.org/grpc@v1.49.0
1.83.1

Open the chart page →

5,076

Container images carrying it

2,727 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/cloudscript-technology/dumpscript:v0.0.42-alpine-edgefce5b6fd161c
google.golang.org/grpc@v1.76.0
1.83.1
1
ghcr.io/cloudtty/cloudshell:v0.8.1023e8d178e02c
google.golang.org/grpc@v1.72.1
1.83.1
1
ghcr.io/cloudtty/cloudshell-operator:v0.8.1014f036e33ef1
google.golang.org/grpc@v1.54.1
1.83.1
1
ghcr.io/clusternet/clusternet-controller-manager:v1.0.02ce077d3d02d
google.golang.org/grpc@v1.65.0
1.83.1
1
ghcr.io/clusternet/clusternet-hub:v1.0.059f75504c5d4
google.golang.org/grpc@v1.65.0
1.83.1
1
ghcr.io/clusternet/clusternet-scheduler:v1.0.0a6ae5aff81ce
google.golang.org/grpc@v1.65.0
1.83.1
1
ghcr.io/cndoit18/lxcfs-agent:latest9853bb613cd0
google.golang.org/grpc@v1.72.0
1.83.1
1
ghcr.io/cohdi/composable-resource-operator:v0.2.23f45bf0a1bc0
google.golang.org/grpc@v1.80.0
1.83.1
1
ghcr.io/comet-ml/opik/opik-python-backend:2.2.68a6ac6318799c
google.golang.org/grpc@v1.80.0
1.83.1
1
ghcr.io/conductionnl/adresservice-php:latestc5075f0320cd
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/authorization-component-php:latest94a749392fcf
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/berichtservice-php:latestee6a21e66ff0
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/brpservice-php:latestc17f1ba17d36
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/contactcatalogus-php:latesteeb625bd660c
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/digispoof-interface-php:latest03aba499950f
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/eav-component-php:latest24bbca4a52a8
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/education-component-php:latestda6b05a1a601
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/eherkenning-ui-php:latestdeed102b4255
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/grafregistratiecomponent-php:latest35225eaa87ab
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/instemmingservice-php:latest4ffe222b3e3a
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/landelijketabellencatalogus-php:latest26d91dcbba56
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/loggingcomponent-php:latest834b8e1af290
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/logicservice-php:latest72aae2080595
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/medewerkercatalogus-php:latest1ea5412bed26
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/memo-component-php:latestef77f4c089a1
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/notification-component-php:latestcd9656e6bc2c
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/ocatiecatalogus-php:latestc22764cbfa97
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/orderregistratiecomponent-php:latestd17257e4fa27
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/procestypecatalogus-php:latest956c4fb64796
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/productenendienstencatalogus-php:latest7242da105081
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/proto-component-commonground-php:latesteb36ead1954e
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/review-component-php:latestafe623824b82
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/taalhuizen-service-php:latest04f1b7f0d573
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/trouw-service-php:latestf745e2870692
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/user-component-php:latest198db44fabb5
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/verhuis-service-php:latest66bbaf95a123
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/verzoekconversieservice-php:lateste918014fb8d3
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/verzoekregistratiecomponent-php:latestc4f6c03af5d3
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/verzoektypecatalogus-php:latest64f5eb7a398b
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/waardepapieren-balie-php:latestf36c423cd259
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/waardepapieren-php:latestb2666ffcbad8
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/waardepapieren-register-php:latest9affab218351
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/conductionnl/webresourcecatalogus-php:latest8f1bbd5cda85
google.golang.org/grpc@v1.27.0
1.83.1
1
ghcr.io/containeroo/agent-forge-operator:v1.1.48f6d8acd134a
google.golang.org/grpc@v1.82.1
1.83.1
1
ghcr.io/containeroo/autovpa:v0.0.3425b801d8d1f7
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/containeroo/cert-manager-webhook-bluecat:latest96f82d5840d4
google.golang.org/grpc@v1.82.1
1.83.1
1
ghcr.io/containeroo/kube-ephemeral-container-exporter:v0.0.14b238f3c58d83
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/containers/kubernetes-mcp-server:v0.0.666d650f4bd6ac
google.golang.org/grpc@v1.81.1
1.83.1
1
ghcr.io/containers/nri-plugins/nri-memory-policy:v0.14.0531d21ec4ba2
google.golang.org/grpc@v1.81.1
1.83.1
1
ghcr.io/containers/nri-plugins/nri-memory-qos:v0.14.0c7c5c24ed894
google.golang.org/grpc@v1.81.1
1.83.1
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.