CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,312; of 17,828 indexed, latest versions
Container images: 2,773; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,312 of 17,828 indexed charts deploy, on 2,773 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,769
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,312 by stars

Chart

Latest

Affected images

Radar Score

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	google.golang.org/grpc@v1.81.0	1.83.1

Open the chart page →

1,061

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

13,934

xonodepoolsxonodepools

1.0.7

1 of 1 See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
xosphere/xonodepools :1.0.7	1458097b6f85	google.golang.org/grpc@v1.72.2	1.83.1

Open the chart page →

402

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.83.1

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

4,928

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.83.1

Open the chart page →

9,769

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,530

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,003

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,773 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
amazon/aws-efs-csi-driver :v0.3.0	b55277652ea8	google.golang.org/grpc@v1.23.0	1.83.1	2
amazon/aws-fsx-csi-driver :latest	c9b14856fd22	google.golang.org/grpc@v1.23.1	1.83.1	2
aquasec/trivy :0.74.0	62b1e65e8869	google.golang.org/grpc@v1.82.1	1.83.1	2
bitnamilegacy/influxdb :2.6.1-debian-11-r18	d17df1f9d745	google.golang.org/grpc@v1.47.0	1.83.1	2
casbin/casdoor :3.62.1	7729da148c61	google.golang.org/grpc@v1.79.3	1.83.1	2
cesanta/docker_auth :1.6.0	4d16885f3d4c	google.golang.org/grpc@v1.21.1	1.83.1	2
chankh/k8s-cloudwatch-adapter :v0.9.0	963c44c7f8b1	google.golang.org/grpc@v1.23.1	1.83.1	2
cloudflare/cloudflared :2026.6.1	6d91c121b803	google.golang.org/grpc@v1.81.1	1.83.1	2
coredns/coredns :1.13.1	9b9128672209	google.golang.org/grpc@v1.75.1	1.83.1	2
crate/crate_adapter :latest	b8d89fa5d19b	google.golang.org/grpc@v1.37.0	1.83.1	2
cs3org/revad :v1.19.0	3b57a34a7dfd	google.golang.org/grpc@v1.47.0	1.83.1	2
cs3org/revad :v1.24.0	e80a4d67b352	google.golang.org/grpc@v1.52.0	1.83.1	2
csiplugin/csi-qingcloud :v1.4.0	0766163dc046	google.golang.org/grpc@v1.26.0	1.83.1	2
datawire/emissary :3.12.2	1f67a1292d2a	google.golang.org/grpc@v1.67.0	1.83.1	2
devopsfaith/krakend :latest	f8bdaa8a1a43	google.golang.org/grpc@v1.66.0	1.83.1	2
dmilhdef/missing-container-metrics :v0.21.0	fada1a6e7638	google.golang.org/grpc@v1.36.0	1.83.1	2
dunglas/mercure :v0 :v0.24.2	916834e49961	google.golang.org/grpc@v1.81.1	1.83.1	2
epamedp/cd-pipeline-operator :2.32.0	fc858071b7a1	google.golang.org/grpc@v1.82.1	1.83.1	2
epamedp/codebase-operator :2.35.0	295a008abcef	google.golang.org/grpc@v1.82.1	1.83.1	2
epamedp/edp-tekton :0.27.0	88189f16f94b	google.golang.org/grpc@v1.82.1	1.83.1	2
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.83.1	2
fluxcd/flux-cli :v2.9.5	704d55295355	google.golang.org/grpc@v1.80.0	1.83.1	2
free5gc/chf :v3.4.3	e2a4dd98a4ed	google.golang.org/grpc@v1.56.3	1.83.1	2
free5gc/webui :v3.4.3	9adeb18492cb	google.golang.org/grpc@v1.56.3	1.83.1	2
goelankit/cortex-gateway :v1.1.0	0d9a82dcf026	google.golang.org/grpc@v1.45.0	1.83.1	2
gomods/athens :v0.11.0	efb811df7844	google.golang.org/grpc@v1.26.0	1.83.1	2
gotenberg/gotenberg :8.36.0	87c16b9f3642	google.golang.org/grpc@v1.83.0	1.83.1	2
governify/dashboard :latest	e83a17ba5038	google.golang.org/grpc@v1.40.0	1.83.1	2
grafana/agent-operator :v0.25.1	a136c6208aa3	google.golang.org/grpc@v1.44.0	1.83.1	2
grafana/alloy :v1.8.1	7790f6f7fbd8	google.golang.org/grpc@v1.71.0	1.83.1	2
grafana/alloy :v1.12.2	f94b1c82957a	google.golang.org/grpc@v1.76.0	1.83.1	2
grafana/grafana :9.2.4	057896e23443	google.golang.org/grpc@v1.45.0	1.83.1	2
grafana/grafana :11.1.0	079600c9517b	google.golang.org/grpc@v1.64.0	1.83.1	2
grafana/grafana :13.0.1	0f86bada30d6	google.golang.org/grpc@v1.79.3	1.83.1	2
grafana/grafana :12.3.1	2175aaa91c96	google.golang.org/grpc@v1.76.0	1.83.1	2
grafana/grafana :8.5.0	42d3e6bc1865	google.golang.org/grpc@v1.42.0	1.83.1	2
grafana/grafana :7.3.5	511bc20bfcd1	google.golang.org/grpc@v1.33.1	1.83.1	2
grafana/grafana :11.1.4	886b56d5534e	google.golang.org/grpc@v1.64.0	1.83.1	2
grafana/grafana :12.3.3	9e1e77ade304	google.golang.org/grpc@v1.78.0	1.83.1	2
grafana/grafana :11.4.0	d8ea37798ccc	google.golang.org/grpc@v1.66.0	1.83.1	2
grafana/grafana :12.4.1	e932bd6ed0e0	google.golang.org/grpc@v1.78.0	1.83.1	2
grafana/loki :3.6.5	847c287ada0e	google.golang.org/grpc@v1.75.1	1.83.1	2
grafana/loki :1.5.0	922b3f412fdd	google.golang.org/grpc@v1.26.0	1.83.1	2
grafana/loki :3.7.7 :latest	d70e4659623f	google.golang.org/grpc@v1.82.1	1.83.1	2
grafana/loki :3.1.0	d947e68a84d9	google.golang.org/grpc@v1.62.1	1.83.1	2
grafana/loki :2.5.0	f9ef133793af	google.golang.org/grpc@v1.44.0	1.83.1	2
grafana/mimir :3.2.0	736f7459913d	google.golang.org/grpc@v1.82.1	1.83.1	2
grafana/promtail :1.5.0	46e88d390cd6	google.golang.org/grpc@v1.26.0	1.83.1	2
grafana/promtail :3.0.0	d3de3da9431c	google.golang.org/grpc@v1.62.1	1.83.1	2
grafana/tempo :2.5.0	f0200a9bff6d	google.golang.org/grpc@v1.63.2	1.83.1	2