CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,305; of 17,813 indexed, latest versions
Container images: 2,756; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,305 of 17,813 indexed charts deploy, on 2,756 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,752
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,305 by stars

Chart

Latest

Affected images

Radar Score

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,526

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,756 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/o0th/cert-manager-webhook-bunny :1.0.2	fe7ce555a12d	google.golang.org/grpc@v1.69.4	1.83.1	1
ghcr.io/oguzhan-yilmaz/argocd-backup-s3 :latest	b61c750ade19	google.golang.org/grpc@v1.15.0	1.83.1	1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots :0.0.203	5bc5ca66d55a	google.golang.org/grpc@v1.73.0	1.83.1	1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots :0.0.55	d7f93d2182fe	google.golang.org/grpc@v1.73.0	1.83.1	1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--powerpipe :latest	a16ab5ca10a7	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe :latest	c0c8d53df9f3	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/okteto/backend :0.0.0-2026-08-17	629bdce31b4d	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/okteto/buildkit :0.0.0-2026-08-03 :0.0.0-2026-08-17	14527ca5d2a9	google.golang.org/grpc@v1.81.1	1.83.1	1
ghcr.io/okteto/okteto :3.22.0	4585017f52f6	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/okteto/registry :0.0.0-2026-08-17	69131511501f	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/olivetin/olivetin :2025.2.19	a89958921526	google.golang.org/grpc@v1.69.2	1.83.1	1
ghcr.io/openclarity/grype-server :v0.6.0	79412399f301	google.golang.org/grpc@v1.55.0	1.83.1	1
ghcr.io/openclarity/kubeclarity :v2.23.3	14450f52a708	google.golang.org/grpc@v1.56.3	1.83.1	1
ghcr.io/openclarity/kubeclarity-sbom-db :v2.23.3	cef2b88bfc76	google.golang.org/grpc@v1.56.3	1.83.1	1
ghcr.io/openconfig/gnmic :0.45.0	d422a9ebd4a2	google.golang.org/grpc@v1.78.0	1.83.1	1
ghcr.io/openfaasltd/gcp-pubsub-connector :0.0.1	8df071f5b719	google.golang.org/grpc@v1.71.0	1.83.1	1
ghcr.io/openfaasltd/headroom-controller :v0.0.4	67d587cc2c39	google.golang.org/grpc@v1.68.1	1.83.1	1
ghcr.io/openfaasltd/pro-builder :0.6.0	6c17297f9098	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/open-feature/flagd :v0.16.0	32234e63c1d0	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/open-feature/flagd :v0.11.1	a7ea52f87446	google.golang.org/grpc@v1.65.0	1.83.1	1
ghcr.io/open-feature/open-feature-operator :v0.9.3	b37a442c0497	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/openlit/openlit :1.24.0	2434560e8f0e	google.golang.org/grpc@v1.77.0	1.83.1	1
ghcr.io/openlit/openlit-controller :0.10.0	165efd4469ea	google.golang.org/grpc@v1.81.1	1.83.1	1
ghcr.io/openlit/openlit-operator :0.0.2	457bb5ada68b	google.golang.org/grpc@v1.68.1	1.83.1	1
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	google.golang.org/grpc@v1.81.1	1.83.1	1
ghcr.io/open-telemetry/demo :1.12.0-productcatalogservice	008b9b662289	google.golang.org/grpc@v1.64.0	1.83.1	1
ghcr.io/open-telemetry/demo :1.12.0-checkoutservice	380eccdc29e9	google.golang.org/grpc@v1.64.0	1.83.1	1
ghcr.io/open-telemetry/demo :1.12.0-shippingservice	a3ca4c02a5df	google.golang.org/grpc@v1.60.1	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-ebpf-instrumentation/ebpf-instrument :v0.9.0	26f82b148dfe	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator :0.148.0	590e50477b76	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator :0.132.0	5e331c925091	google.golang.org/grpc@v1.73.0	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator :0.144.0	79b81912f1fb	google.golang.org/grpc@v1.77.0	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator :0.150.0	89490ef63b72	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator :0.158.0	d4789a6537fd	google.golang.org/grpc@v1.83.0	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-operator/target-allocator :0.124.0	8936271cf56a	google.golang.org/grpc@v1.71.0	1.83.1	1
ghcr.io/opnpulse/tenant-operator :v0.0.2	787f6de2b620	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/opnpulse/thanos-operator :v2026.4.24	e05a3e701291	google.golang.org/grpc@v1.76.0	1.83.1	1
ghcr.io/orkspace/orkestra :0.7.17	38c388cfc8d1	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/ownkube/kubernetes-events-exporter :0.1.2	bcb7f0f733f5	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/oxidecomputer/cluster-api-provider-oxide :0.2.3	7b05d3bbfbfa	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/parca-dev/parca :v0.24.2	3776500fde82	google.golang.org/grpc@v1.75.0	1.83.1	1
ghcr.io/parca-dev/parca-agent :v0.28.0	6d6794f45f3e	google.golang.org/grpc@v1.59.0	1.83.1	1
ghcr.io/parca-dev/parca-agent :v0.42.0	adc0eeb4dd05	google.golang.org/grpc@v1.74.2	1.83.1	1
ghcr.io/parmincloud/arvancloud-certmanager-issuer :v1.0.0	0b97452674a3	google.golang.org/grpc@v1.75.1	1.83.1	1
ghcr.io/pbufio/registry :v0.4.1	77a36c035b4b	google.golang.org/grpc@v1.76.0	1.83.1	1
ghcr.io/peak-scale/capsule-argo-addon :0.7.5	087a80163971	google.golang.org/grpc@v1.73.0	1.83.1	1
ghcr.io/peak-scale/observability-tenancy/loki-proxy :0.4.1	548e962d0061	google.golang.org/grpc@v1.73.0	1.83.1	1
ghcr.io/peak-scale/sops-operator :0.10.1	1da9b716b792	google.golang.org/grpc@v1.82.0	1.83.1	1
ghcr.io/performancecopilot/archive-analysis :latest	8de11e2363fc	google.golang.org/grpc@v1.66.0	1.83.1	1
ghcr.io/permify/permify :v1.3.5	f0c6f7d7daa6	google.golang.org/grpc@v1.64.0	1.83.1	1