CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,305; of 17,813 indexed, latest versions
Container images: 2,756; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,305 of 17,813 indexed charts deploy, on 2,756 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,752
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,305 by stars

Chart

Latest

Affected images

Radar Score

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,526

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,756 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
public.ecr.aws/aws-observability/aws-otel-collector :v0.49.0	d2bdfff2c377	google.golang.org/grpc@v1.82.0	1.83.1	1
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws :1.0.r2-2021.08.13.20.34-linux-amd64	02aed3370fce	google.golang.org/grpc@v1.35.0	1.83.1	1
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws :1.0.r2-35-g41dc61e-2022.12.16.20.38	363bd65cd707	google.golang.org/grpc@v1.49.0	1.83.1	1
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws :1.0.r1-10-g1942553-2021.06.04.00.07-linux-amd64	b32c99e7bc45	google.golang.org/grpc@v1.35.0	1.83.1	1
public.ecr.aws/boundless-software/switchblade :release-v0.0.19-lcm	01d8413d5075	google.golang.org/grpc@v1.60.1	1.83.1	1
public.ecr.aws/buildkite/agent-metrics :v5.11.0	16e7f5c7161e	google.golang.org/grpc@v1.75.0	1.83.1	1
public.ecr.aws/cloudnatix/llmariner/cluster-monitor-agent :0.10.2	6769c2275a43	google.golang.org/grpc@v1.73.0	1.83.1	1
public.ecr.aws/cloudnatix/llmariner/inference-manager-server :1.46.0	0bbb5f5ddf71	google.golang.org/grpc@v1.79.3	1.83.1	1
public.ecr.aws/cloudnatix/llmariner/inference-manager-server :1.45.0	90b890f800ab	google.golang.org/grpc@v1.67.1	1.83.1	1
public.ecr.aws/cloudnatix/llmariner/job-manager-syncer :1.27.0	86957bbeeff5	google.golang.org/grpc@v1.67.0	1.83.1	1
public.ecr.aws/cloudnatix/llmariner/session-manager-agent :1.9.0	b9f23db99051	google.golang.org/grpc@v1.67.1	1.83.1	1
public.ecr.aws/cloudnatix/llmariner/session-manager-server :0.1.0-gfu-dev	b9537499ff9e	google.golang.org/grpc@v1.67.1	1.83.1	1
public.ecr.aws/cloudnatix/llmariner/session-manager-server :1.9.0	f24ecd37fbaa	google.golang.org/grpc@v1.67.1	1.83.1	1
public.ecr.aws/cloudpilotai/gcp/karpenter :v0.6.0	aab80cfd2c4e	google.golang.org/grpc@v1.82.1	1.83.1	1
public.ecr.aws/csi-components/csi-node-driver-registrar :v2.16.0-eksbuild.3	592d7034d6c7	google.golang.org/grpc@v1.79.3	1.83.1	1
public.ecr.aws/csi-components/livenessprobe :v2.18.0-eksbuild.3	8e307f4e5820	google.golang.org/grpc@v1.79.3	1.83.1	1
public.ecr.aws/datadog/agent :7.73.0	f4925b15ce94	google.golang.org/grpc@v1.76.0	1.83.1	1
public.ecr.aws/diagrid-dev/diagrid-dashboard :latest	f1348a65664a	google.golang.org/grpc@v1.80.0	1.83.1	1
public.ecr.aws/docker/library/caddy :2.6.3	87cbd356af2e	google.golang.org/grpc@v1.52.3	1.83.1	1
public.ecr.aws/dynatrace/dynatrace-operator :v1.10.2	52281db48c93	google.golang.org/grpc@v1.82.1	1.83.1	1
public.ecr.aws/dynatrace/dynatrace-operator :v1.3.0	f68901a54664	google.golang.org/grpc@v1.65.0	1.83.1	1
public.ecr.aws/eks-distro/kubernetes/kube-scheduler :v1.29.14-eks-1-29-latest	e7e1db003e6a	google.golang.org/grpc@v1.59.0	1.83.1	1
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	google.golang.org/grpc@v1.79.3	1.83.1	1
public.ecr.aws/groundcovercom/kong/kubernetes-ingress-controller :3.5.3-20260205	bf9db911deed	google.golang.org/grpc@v1.73.0	1.83.1	1
public.ecr.aws/groundcovercom/loki-proxy :0.1.1	783d550ad813	google.golang.org/grpc@v1.44.0	1.83.1	1
public.ecr.aws/groundcovercom/temporalio/admin-tools :1.29.7-20260730-1	af8cea3b8538	google.golang.org/grpc@v1.56.3	1.83.1	1
public.ecr.aws/groundcovercom/temporalio/server :1.29.6-mini-20260702-1	70f191d0a80e	google.golang.org/grpc@v1.79.3	1.83.1	1
public.ecr.aws/k4y9r6y5/kratos :v25.4.0	e8014c6c58b6	google.golang.org/grpc@v1.74.2	1.83.1	1
public.ecr.aws/karpenter/controller :v0.19.3	f0e5ab60b2df	google.golang.org/grpc@v1.47.0	1.83.1	1
public.ecr.aws/lumigo/lumigo-kubernetes-rbac-proxy :69	6c2f0585cd6c	google.golang.org/grpc@v1.47.0	1.83.1	1
public.ecr.aws/lumigo/lumigo-kubernetes-telemetry-proxy :69	1d548e59c2c8	google.golang.org/grpc@v1.72.1	1.83.1	1
public.ecr.aws/lumigo/lumigo-kubernetes-watchdog :69	6458fcd61e0c	google.golang.org/grpc@v1.71.1	1.83.1	1
public.ecr.aws/n8h5y2v5/rad-security/rad-sbom :v1.1.34	e97e0e7a2088	google.golang.org/grpc@v1.65.0	1.83.1	1
public.ecr.aws/neuron/neuron-device-plugin :2.23.30.0	75a6d5ce3bd3	google.golang.org/grpc@v1.60.1	1.83.1	1
public.ecr.aws/optimizely/webhook-broker :v0.2.3	cfc92cc2de65	google.golang.org/grpc@v1.65.0	1.83.1	1
public.ecr.aws/perfectscale-io/psc-exporter :v1.0.45-redhat	9083e60c38bc	google.golang.org/grpc@v1.62.1	1.83.1	1
public.ecr.aws/r3m4q3r9/pleco :0.24.0	651739583336	google.golang.org/grpc@v1.58.3	1.83.1	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	google.golang.org/grpc@v1.44.0	1.83.1	1
public.ecr.aws/truefoundrycloud/eks/eks-node-monitoring-agent :v1.5.1-eksbuild.1	988c8e1a273a	google.golang.org/grpc@v1.77.0	1.83.1	1
public.ecr.aws/v0r6c2e2/minio :latest	08c90bd040bf	google.golang.org/grpc@v1.69.2	1.83.1	1
quay.io/ansible/awx-operator :2.19.1	7302e0c8e5a7	google.golang.org/grpc@v1.60.1	1.83.1	1
quay.io/argoproj/argocd :v3.5.1	0deb1a1c9176	google.golang.org/grpc@v1.81.1	1.83.1	1
quay.io/argoproj/argocd :v2.4.11	5b6701d8fb31	google.golang.org/grpc@v1.45.0	1.83.1	1
quay.io/argoproj/argocd :v3.0.3	95b5cf7ba6fe	google.golang.org/grpc@v1.71.0	1.83.1	1
quay.io/argoproj/argocd :v3.1.1	a36ab0c0860c	google.golang.org/grpc@v1.68.1	1.83.1	1
quay.io/argoproj/argocd :v2.8.6	acaf37352569	google.golang.org/grpc@v1.58.3	1.83.1	1
quay.io/argoproj/argocli :v3.7.11	577fc18f86ad	google.golang.org/grpc@v1.72.2	1.83.1	1
quay.io/argoproj/argocli :v3.7.1	6efd1cb89dc1	google.golang.org/grpc@v1.72.2	1.83.1	1
quay.io/argoproj/argocli :v3.5.5	91b9825f09a8	google.golang.org/grpc@v1.59.0	1.83.1	1
quay.io/argoproj/argo-events :v1.9.10	a83d2699ae53	google.golang.org/grpc@v1.78.0	1.83.1	1