CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,305; of 17,813 indexed, latest versions
Container images: 2,756; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,305 of 17,813 indexed charts deploy, on 2,756 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,752
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,305 by stars

Chart

Latest

Affected images

Radar Score

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,526

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,756 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/glauth/glauth :v2.5.2	09c782ca5984	google.golang.org/grpc@v1.59.0	1.83.1	1
ghcr.io/gnana997/periscope :1.1.6	21b284fb00f2	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/gochain/rpc-proxy/rpc-proxy :latest	ca01f5ab95f7	google.golang.org/grpc@v1.69.2	1.83.1	1
ghcr.io/gomenhashai/gomenhashai :v1.3.3	6f031172a5ec	google.golang.org/grpc@v1.72.2	1.83.1	1
ghcr.io/googlecloudplatform/k8s-aibom	05e86c39c535	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/grafana/alloy-operator :1.3.0	2088dcb22aaa	google.golang.org/grpc@v1.73.0	1.83.1	1
ghcr.io/grafana/alloy-operator :1.7.0	2ce23f948e02	google.golang.org/grpc@v1.75.1	1.83.1	1
ghcr.io/grafana/alloy-operator :1.12.1	4ee4b71cf16a	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/grafana/alloy-operator :1.8.1	ae85d68749c7	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/grafana/k6-operator :controller-v1.6.0	ba7f0fc1e22e	google.golang.org/grpc@v1.83.0	1.83.1	1
ghcr.io/grafana/k8s-injection-controller :0.2.0	c5bad40655a3	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/grycap/oscar :latest	0c58ff972451	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/gurucomputing/headscale-ui :2026.03.17	015f5ba04bcb	google.golang.org/grpc@v1.73.0	1.83.1	1
ghcr.io/haedalwang/kubescout :0.1.1	07d51f838f0d	google.golang.org/grpc@v1.72.1	1.83.1	1
ghcr.io/haydercyber/secrets-bridge :0.2.0	4709f1bb3039	google.golang.org/grpc@v1.65.0	1.83.1	1
ghcr.io/headlamp-k8s/headlamp :v0.43.0	5d03caa26df7	google.golang.org/grpc@v1.81.1	1.83.1	1
ghcr.io/helm/chartmuseum :v0.16.6	48bc27743c08	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/helm/chartmuseum :v0.16.0	71d1f1c0179e	google.golang.org/grpc@v1.55.0	1.83.1	1
ghcr.io/helm/chartmuseum :v0.14.0	878ef6a31fa0	google.golang.org/grpc@v1.43.0	1.83.1	1
ghcr.io/helm/chartmuseum :v0.15.0	c298183a5208	google.golang.org/grpc@v1.47.0	1.83.1	1
ghcr.io/helm/chartmuseum :v0.16.3	c81f105c3682	google.golang.org/grpc@v1.65.0	1.83.1	1
ghcr.io/helmfile/helmfile :v1.8.0	1808ffb76f37	google.golang.org/grpc@v1.71.1	1.83.1	1
ghcr.io/honeycombio/kspan/kspan :0.2	c966a4f8a4b7	google.golang.org/grpc@v1.36.0	1.83.1	1
ghcr.io/hsn723/cert-estuary :0.2.0	0c4b6132b0ad	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/idebeijer/gameserver-operator :latest	1b099cfe9e5e	google.golang.org/grpc@v1.72.2	1.83.1	1
ghcr.io/ignisda/ryot :v10.5.0	a752b6aee537	google.golang.org/grpc@v1.67.1	1.83.1	1
ghcr.io/igrikus/garm-operator :4.2.0	9e24d8a6a3b2	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/imcitius/checker-edge :1.1.11	74426c1fe00f	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/imgproxy/imgproxy :v3.30.0	74c1bee92e04	google.golang.org/grpc@v1.75.1	1.83.1	1
ghcr.io/indeedeng/harbor-container-webhook :main	45ca15fc294f	google.golang.org/grpc@v1.71.0	1.83.1	1
ghcr.io/inlets/inlets-operator :0.17.22	08265c006973	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/interhyp/git-hubby :0.8.15	7361cd99d5ca	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/interlink-hq/interlink/virtual-kubelet-inttw :latest	0e05a7b49c33	google.golang.org/grpc@v1.72.2	1.83.1	1
ghcr.io/invergent-ai/surogate-hub :latest	6d4106724d56	google.golang.org/grpc@v1.75.0	1.83.1	1
ghcr.io/ioxie/velkir/manager :v0.1.2	02c657d62d1d	google.golang.org/grpc@v1.82.0	1.83.1	1
ghcr.io/itakurah/kubernetes-event-exporter :v1.7	8abb52b66557	google.golang.org/grpc@v1.53.0	1.83.1	1
ghcr.io/itzg/minecraft-server :latest	46919d151d39	google.golang.org/grpc@v1.83.0	1.83.1	1
ghcr.io/jaconi-io/koptimize :1.2.5	aca1bbd609b6	google.golang.org/grpc@v1.55.0	1.83.1	1
ghcr.io/jarodr47/portager :0.5.0	6a7a61b37568	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	google.golang.org/grpc@v1.65.0	1.83.1	1
ghcr.io/juanfont/headscale :0.29.3-debug	842cd94b754b	google.golang.org/grpc@v1.81.1	1.83.1	1
ghcr.io/juanfont/headscale :0.29.1	8453e47ea6bf	google.golang.org/grpc@v1.81.1	1.83.1	1
ghcr.io/juanfont/headscale :v0.25.0	97febecbe6cb	google.golang.org/grpc@v1.69.0	1.83.1	1
ghcr.io/justwatchcom/sql_exporter :v0.8	c4b1d3d0f052	google.golang.org/grpc@v1.67.1	1.83.1	1
ghcr.io/k8sgpt-ai/k8sgpt-operator :v0.2.29	82d0adcce816	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/k8s-lynq/lynq :1.1.22	229b05e3c717	google.golang.org/grpc@v1.68.1	1.83.1	1
ghcr.io/k8snetworkplumbingwg/multus-cni :v4.2.4-thick	3c20900b5381	google.golang.org/grpc@v1.73.0	1.83.1	1
ghcr.io/k8snetworkplumbingwg/multus-cni :v4.2.1	6bebbda31416	google.golang.org/grpc@v1.58.3	1.83.1	1
ghcr.io/k8snetworkplumbingwg/multus-cni :v4.1.3	9751856cacc8	google.golang.org/grpc@v1.58.3	1.83.1	1
ghcr.io/k8snetworkplumbingwg/multus-cni :latest-thick	b2136983532b	google.golang.org/grpc@v1.82.1	1.83.1	1