StackRadar

CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,305
of 17,813 indexed, latest versions
Container images
2,756
deployed by those charts
Fix available
1 of 2
affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,305 of 17,813 indexed charts deploy, on 2,756 images.

Affected packageAffected versionsFixed inImages
google.golang.org/grpcgolangv0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more1.83.12,752
grpcdeb1.16.1-1ubuntu5, 1.51.1-4.1build5no fix listed4
OSV records
GHSA-qc2q-p7wx-3px3UBUNTU-CVE-2026-84303
Also known as
GO-2026-6441

Charts affected

2,305 by stars
ChartLatestAffected imagesRadar Score
ygdrassil-monitoringygdrassilVerified publisher0.4.02 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
google.golang.org/grpc@v1.69.2
1.83.1
quay.io/prometheus/prometheus:v3.1.06559acbd5d77
google.golang.org/grpc@v1.69.0
1.83.1

Open the chart page →

9,526
matrixdb-operatorymatrixOfficialVerified publisher0.13.01 of 2See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
matrixdb/kubebuilder_kube-rbac-proxy:v0.12.0ed3c7e6291e8
google.golang.org/grpc@v1.40.0
1.83.1

Open the chart page →

1,966
rawfile-csiymatrixVerified publisher0.2.14 of 4See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
matrixdb/custom-external-provisioner:4622a07d7-202204247e9ffe249a51
google.golang.org/grpc@v1.40.0
1.83.1
matrixdb/rawfile-csi:v0.2.195b2e38e913d
google.golang.org/grpc@v1.45.0
1.83.1
matrixdb/sig-storage_csi-node-driver-registrar:v2.2.0ba763bb01ddc
google.golang.org/grpc@v1.36.0
1.83.1
matrixdb/sig-storage_livenessprobe:v2.3.07ab06fe3d8a7
google.golang.org/grpc@v1.36.0
1.83.1

Open the chart page →

8,002
prometheus-monitoring-stackyotron-helm-charts1.2.03 of 3See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
google.golang.org/grpc@v1.81.1
1.83.1
quay.io/prometheus/alertmanager:latest690c7b525f43
google.golang.org/grpc@v1.82.1
1.83.1
quay.io/prometheus/prometheus:latest5ce7540c3c00
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

936
zahori-consulzahoriVerified publisher1.0.12 of 2See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
google.golang.org/grpc@v1.49.0
1.83.1
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
google.golang.org/grpc@v1.49.0
1.83.1

Open the chart page →

5,077

Container images carrying it

2,756 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/upcloudltd/upcloud-csi5af91c663788
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/usememos/memos:0.24.04723d86e6797
google.golang.org/grpc@v1.69.2
1.83.1
1
ghcr.io/v6d-io/v6d/kube-rbac-proxy:v0.13.0a2523c532c0c
google.golang.org/grpc@v1.40.0
1.83.1
1
ghcr.io/valkey-io/valkey-operator:v0.6.052a0f1ed0c03
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/vedooo/reactive-policy:0.4.1d92eda891c91
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/voidmind-io/voidllm:0.0.250df11dd20c28
google.golang.org/grpc@v1.82.1
1.83.1
1
ghcr.io/vojtechpastyrik/muthur:0.10.0b5a06a6e13b9
google.golang.org/grpc@v1.81.1
1.83.1
1
ghcr.io/vojtechpastyrik/muthur-collector:0.11.00a580fe3a032
google.golang.org/grpc@v1.81.1
1.83.1
1
ghcr.io/voyagermesh/crd-manager:v0.1.013fd0cccafe8
google.golang.org/grpc@v1.75.1
1.83.1
1
ghcr.io/voyagermesh/gateway:v1.6.223f4da194134
google.golang.org/grpc@v1.76.0
1.83.1
1
ghcr.io/voyagermesh/gateway:v0.0.1a8a144f14889
google.golang.org/grpc@v1.54.0
1.83.1
1
ghcr.io/voyagermesh/gateway-converter:v0.0.1b92123805584
google.golang.org/grpc@v1.63.2
1.83.1
1
ghcr.io/voyagermesh/voyager:v17.5.04964ceaf9d35
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/warpstreamlabs/bento:1.8.121715979aefa
google.golang.org/grpc@v1.70.0
1.83.1
1
ghcr.io/wasilak/go-hello-world:1.8.366d353e7693f
google.golang.org/grpc@v1.77.0
1.83.1
1
ghcr.io/wundergraph/cosmo/otelcollector:0.18.15a6fe78d4d15
google.golang.org/grpc@v1.64.0
1.83.1
1
ghcr.io/wundergraph/cosmo/router:0.243.05afcab98d9d7
google.golang.org/grpc@v1.68.1
1.83.1
1
ghcr.io/xmv-solutions-gmbh/cert-manager-webhook-hcloud-zones:0.1.5a7a846bba3e8
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/ydixken/pgcopydb-operator:v0.13.306096c6ec357
google.golang.org/grpc@v1.82.2
1.83.1
1
ghcr.io/zapier/kubechecks:latest60cea46ce830
google.golang.org/grpc@v1.83.0
1.83.1
1
ghcr.io/zeiss/typhoon/controller:0.2.34fdf4edfda45
google.golang.org/grpc@v1.70.0
1.83.1
1
ghcr.io/zeiss/typhoon/typhoon-webhook:0.2.378f9b82050bc
google.golang.org/grpc@v1.70.0
1.83.1
1
ghcr.io/zufardhiyaulhaq/frp-operator:v0.11.0cd25ee354df2
google.golang.org/grpc@v1.58.3
1.83.1
1
mcr.microsoft.com/acstor/local-csi-driver:v0.3.0f9af53a79fd1
google.golang.org/grpc@v1.83.0
1.83.1
1
mcr.microsoft.com/acstor/local-csi-manager:v0.3.04f464b52ba85
google.golang.org/grpc@v1.83.0
1.83.1
1
mcr.microsoft.com/aks/kaito/gpu-provisioner:0.2.01204a7e948e9
google.golang.org/grpc@v1.56.3
1.83.1
1
mcr.microsoft.com/aks/kaito/ragengine:0.12.07bfe651c92db
google.golang.org/grpc@v1.82.1
1.83.1
1
mcr.microsoft.com/aks/kaito/workspace:0.12.0c4b887ca0542
google.golang.org/grpc@v1.82.1
1.83.1
1
mcr.microsoft.com/application-lb/images/alb-controller:1.12.172f33b24bc67
google.golang.org/grpc@v1.82.1
1.83.1
1
mcr.microsoft.com/application-lb/images/alb-controller-bootstrap:1.12.1cc129fd1c904
google.golang.org/grpc@v1.82.1
1.83.1
1
mcr.microsoft.com/k8s/csi/azuredisk-csi:v1.1.1ec1803037ed9
google.golang.org/grpc@v1.27.0
1.83.1
1
mcr.microsoft.com/oss/kubernetes-csi/csi-attacher:v2.2.0f55f30876129
google.golang.org/grpc@v1.26.0
1.83.1
1
mcr.microsoft.com/oss/kubernetes-csi/csi-node-driver-registrar:v2.0.1fc5d14e9f26f
google.golang.org/grpc@v1.27.0
1.83.1
1
mcr.microsoft.com/oss/kubernetes-csi/csi-provisioner:v1.6.1667b1b1ea1e4
google.golang.org/grpc@v1.26.0
1.83.1
1
mcr.microsoft.com/oss/kubernetes-csi/csi-resizer:v1.1.07997e0f236bc
google.golang.org/grpc@v1.34.0
1.83.1
1
mcr.microsoft.com/oss/kubernetes-csi/livenessprobe:v2.2.0b7d82802cca8
google.golang.org/grpc@v1.34.0
1.83.1
1
mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.76e43ba0bd009
google.golang.org/grpc@v1.82.0
1.83.1
1
mcr.microsoft.com/oss/v2/kubernetes-csi/blob-csi:v1.27.9f9e20264150a
google.golang.org/grpc@v1.82.0
1.83.1
1
mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar:v2.14.06cb172e3de7e
google.golang.org/grpc@v1.72.1
1.83.1
1
mcr.microsoft.com/oss/v2/kubernetes-csi/csi-provisioner:v5.2.0afdfa3da79df
google.golang.org/grpc@v1.69.2
1.83.1
1
mcr.microsoft.com/oss/v2/kubernetes-csi/csi-resizer:v1.13.2fa8eba9843ff
google.golang.org/grpc@v1.69.2
1.83.1
1
mcr.microsoft.com/oss/v2/kubernetes-csi/csi-snapshotter:v8.5.08b3ce8339944
google.golang.org/grpc@v1.82.1
1.83.1
1
mcr.microsoft.com/oss/v2/kubernetes-csi/livenessprobe:v2.15.059b9d0348428
google.golang.org/grpc@v1.71.0
1.83.1
1
mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.5.65f91243cfd60
google.golang.org/grpc@v1.56.3
1.83.1
1
mcr.microsoft.com/oss/v2/nvidia/k8s-device-plugin:v0.18.2-125a4e52c87bb9
google.golang.org/grpc@v1.82.1
1.83.1
1
public.ecr.aws/aktosecurity/keelhq-keel:akto_v1.0.01eb61443d68e
google.golang.org/grpc@v1.68.0
1.83.1
1
public.ecr.aws/aws-containers/retail-store-sample-catalog:1.3.0b654b266fa32
google.golang.org/grpc@v1.73.0
1.83.1
1
public.ecr.aws/aws-ec2/aws-node-termination-handler-2/controller:v2.0.0-beta9637c80dd23f
google.golang.org/grpc@v1.42.0
1.83.1
1
public.ecr.aws/aws-ec2/aws-node-termination-handler-2/webhook:v2.0.0-beta86b0f7243250
google.golang.org/grpc@v1.42.0
1.83.1
1
public.ecr.aws/aws-observability/aws-otel-collector:v0.43.38aa9ea5f67b8
google.golang.org/grpc@v1.69.2
1.83.1
1

syft 1.42.1 · advisories as of 20 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.