CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,275; of 17,813 indexed, latest versions
Container images: 2,703; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,275 of 17,813 indexed charts deploy, on 2,703 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,700
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	3

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,275 by stars

Chart

Latest

Affected images

Radar Score

victoria-metrics-k8s-stackwenerme

0.92.1

3 of 7 See more

victoria-metrics-k8s-stack wenerme 0.92.1

3 of the 7 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :13.1.1	7cb8c64c4d57	google.golang.org/grpc@v1.81.1	1.83.1
victoriametrics/operator :v0.74.1	7310c4a80b94	google.golang.org/grpc@v1.82.1	1.83.1
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.19.1	85108987d044	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

1,954

victoria-metrics-operatorwenerme

0.67.3

1 of 1 See more

victoria-metrics-operator wenerme 0.67.3

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
victoriametrics/operator :v0.74.1	7310c4a80b94	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

125

wexa-studiowexa-studio

1.2.0

5 of 15 See more

wexa-studio wexa-studio 1.2.0

5 of the 15 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.15.4	0b01ed3924e6	google.golang.org/grpc@v1.58.3	1.83.1
minio/minio :RELEASE.2024-01-16T16-07-38Z	4c4a4876193f	google.golang.org/grpc@v1.60.1	1.83.1
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	google.golang.org/grpc@v1.56.3	1.83.1
temporalio/server :1.29.1	c1e3326b2ce1	google.golang.org/grpc@v1.72.2	1.83.1
temporalio/ui :2.44.0	0b36e00aad30	google.golang.org/grpc@v1.66.1	1.83.1

Open the chart page →

15,387

ceph-csi-cephfswikimedia

0.1.8

5 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

5 of the 5 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
gcr.io/k8s-staging-sig-storage/csi-provisioner :v3.2.1	4ad5fcdbe7e9	google.golang.org/grpc@v1.45.0	1.83.1
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	google.golang.org/grpc@v1.48.0	1.83.1
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.5.1	0103eee7c35e	google.golang.org/grpc@v1.40.0	1.83.1
registry.k8s.io/sig-storage/csi-resizer :v1.5.0	8f7520bd957e	google.golang.org/grpc@v1.40.0	1.83.1
registry.k8s.io/sig-storage/csi-snapshotter :v6.0.1	ad16874e2140	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

10,334

ceph-csi-rbdwikimedia

0.1.13

6 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

6 of the 6 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
gcr.io/k8s-staging-sig-storage/csi-provisioner :v3.2.1	4ad5fcdbe7e9	google.golang.org/grpc@v1.45.0	1.83.1
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	google.golang.org/grpc@v1.48.0	1.83.1
registry.k8s.io/sig-storage/csi-attacher :v3.5.0	dd245051317e	google.golang.org/grpc@v1.40.0	1.83.1
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.5.1	0103eee7c35e	google.golang.org/grpc@v1.40.0	1.83.1
registry.k8s.io/sig-storage/csi-resizer :v1.5.0	8f7520bd957e	google.golang.org/grpc@v1.40.0	1.83.1
registry.k8s.io/sig-storage/csi-snapshotter :v6.0.1	ad16874e2140	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

11,840

jaegerwikimedia

3.1.2

3 of 4 See more

jaeger wikimedia 3.1.2

3 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-agent :1.53.0	0214a0ef24b1	google.golang.org/grpc@v1.60.0	1.83.1
jaegertracing/jaeger-collector :1.53.0	7f1269222903	google.golang.org/grpc@v1.60.0	1.83.1
jaegertracing/jaeger-query :1.53.0	049bb0d64ea3	google.golang.org/grpc@v1.60.0	1.83.1

Open the chart page →

9,365

opentelemetry-collectorwikimedia

0.62.7

1 of 1 See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.81.0	c6671841470b	google.golang.org/grpc@v1.56.1	1.83.1

Open the chart page →

2,035

wireguardwireguard-bananas

1.5.0

1 of 1 See more

wireguard wireguard-bananas 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
place1/wg-access-server :v0.4.6	2b2f3ea80ed6	google.golang.org/grpc@v1.30.0	1.83.1

Open the chart page →

2,753

csi-driver-host-pathwiremind

0.1.1

8 of 8 See more

csi-driver-host-path wiremind 0.1.1

8 of the 8 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.0.0	9a685020911e	google.golang.org/grpc@v1.47.0	1.83.1
registry.k8s.io/sig-storage/csi-external-health-monitor-controller :v0.7.0	80b9ba94aa2a	google.golang.org/grpc@v1.48.0	1.83.1
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.6.0	f1c25991bac2	google.golang.org/grpc@v1.50.1	1.83.1
registry.k8s.io/sig-storage/csi-provisioner :v3.3.0	ee3b525d5b89	google.golang.org/grpc@v1.49.0	1.83.1
registry.k8s.io/sig-storage/csi-resizer :v1.6.0	425d8f1b7693	google.golang.org/grpc@v1.47.0	1.83.1
registry.k8s.io/sig-storage/csi-snapshotter :v6.1.0	291334908ddf	google.golang.org/grpc@v1.47.0	1.83.1
registry.k8s.io/sig-storage/hostpathplugin :v1.9.0	92257881c1d6	google.golang.org/grpc@v1.34.0	1.83.1
registry.k8s.io/sig-storage/livenessprobe :v2.8.0	cacee2b5c36d	google.golang.org/grpc@v1.48.0	1.83.1

Open the chart page →

12,666

orcwiremind

0.3.0

1 of 1 See more

orc wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
quay.io/orc/openstack-resource-controller :v2.5.0	79f22af49612	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

277

registrywiremind

0.1.1

1 of 1 See more

registry wiremind 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/distribution/distribution :3.0.0	4ba3adf47f5c	google.golang.org/grpc@v1.68.0	1.83.1

Open the chart page →

1,358

kafka-connect-uiwitcom-gmbh

0.5.0

1 of 2 See more

kafka-connect-ui witcom-gmbh 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.3.0	8c21390be87d	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

2,513

mrtg-backendwitcom-gmbh

0.7.0

1 of 2 See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.2.1	febeebebe762	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

2,624

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	google.golang.org/grpc@v1.81.0	1.83.1

Open the chart page →

1,060

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

13,895

xonodepoolsxonodepools

1.0.7

1 of 1 See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
xosphere/xonodepools :1.0.7	1458097b6f85	google.golang.org/grpc@v1.72.2	1.83.1

Open the chart page →

402

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.83.1

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

4,926

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.83.1

Open the chart page →

9,730

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,518

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,703 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/openshift/origin-csi-external-attacher :latest	4f9b3d0f2c7f	google.golang.org/grpc@v1.82.1	1.83.1	1
quay.io/openshift/origin-csi-external-provisioner :latest	e4074ec254f5	google.golang.org/grpc@v1.82.1	1.83.1	1
quay.io/openshift/origin-csi-node-driver-registrar :latest	ea08b5e5f4ab	google.golang.org/grpc@v1.82.1	1.83.1	1
quay.io/operator-framework/catalogd :v1.8.0	6ff40fa6257f	google.golang.org/grpc@v1.78.0	1.83.1	1
quay.io/operator-framework/olm	1b6002156f56	google.golang.org/grpc@v1.60.1	1.83.1	1
quay.io/operator-framework/olm	40d0363f4aa6	google.golang.org/grpc@v1.63.2	1.83.1	1
quay.io/operator-framework/olm :v0.45.0	f228c7a6b8c5	google.golang.org/grpc@v1.81.1	1.83.1	1
quay.io/operator-framework/olm	f9ea8cef95ac	google.golang.org/grpc@v1.40.0	1.83.1	1
quay.io/operator-framework/operator-controller :v1.8.0	bca5dfcc67ca	google.golang.org/grpc@v1.78.0	1.83.1	1
quay.io/opsmxpublic/forwarder-controller :v3.5.7	f0c5bebaec96	google.golang.org/grpc@v1.49.0	1.83.1	1
quay.io/opsmxpublic/opa :1.12.0	84fb1af7401c	google.golang.org/grpc@v1.77.0	1.83.1	1
quay.io/opstree/grafana :12.4.3	b61c1ed2f015	google.golang.org/grpc@v1.80.0	1.83.1	1
quay.io/opstree/kube-state-metrics :2.18.0-debian13	53525d253793	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/opstree/loki :3.6-debian13	bdfee214c7ea	google.golang.org/grpc@v1.80.0	1.83.1	1
quay.io/opstree/opentelemetry-operator :0.149.0-debian13	a21405ab9a9a	google.golang.org/grpc@v1.80.0	1.83.1	1
quay.io/opstree/redis-operator :v0.26.0	1c6818e5e505	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/opstree/tempo :2.10.4-debian13	cb734024b3fd	google.golang.org/grpc@v1.80.0	1.83.1	1
quay.io/opstree/victoriametrics-operator :v0.69.0	66fe5216c278	google.golang.org/grpc@v1.80.0	1.83.1	1
quay.io/orc/openstack-resource-controller :v2.5.0	79f22af49612	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/piraeusdatastore/nri-volume-qos :v0.1.3	cbe3e1ea2b6a	google.golang.org/grpc@v1.81.1	1.83.1	1
quay.io/piraeusdatastore/piraeus-operator :v2.10.5	dd68a66332de	google.golang.org/grpc@v1.79.2	1.83.1	1
quay.io/projectquay/clair :4.9.0	23329c3368e4	google.golang.org/grpc@v1.77.0	1.83.1	1
quay.io/prometheus/alertmanager :v0.32.0	58e117eabcce	google.golang.org/grpc@v1.80.0	1.83.1	1
quay.io/prometheus/alertmanager :v0.31.1	88b605de9aba	google.golang.org/grpc@v1.78.0	1.83.1	1
quay.io/prometheus-operator/prometheus-operator :v0.93.0	a001ed10a382	google.golang.org/grpc@v1.82.1	1.83.1	1
quay.io/prometheus-operator/prometheus-operator :v0.57.0	a2d502c204f9	google.golang.org/grpc@v1.44.0	1.83.1	1
quay.io/prometheus-operator/prometheus-operator :v0.54.0	be2aef39a2f8	google.golang.org/grpc@v1.40.0	1.83.1	1
quay.io/prometheus-operator/prometheus-operator :v0.61.1	cd7d1a82ef00	google.golang.org/grpc@v1.50.1	1.83.1	1
quay.io/prometheus-operator/prometheus-operator :v0.93.1	e52bb28fd41c	google.golang.org/grpc@v1.82.1	1.83.1	1
quay.io/prometheus/prometheus :v3.0.0	3b9b2a15d376	google.golang.org/grpc@v1.67.1	1.83.1	1
quay.io/prometheus/prometheus :v2.39.1	4748e26f9369	google.golang.org/grpc@v1.49.0	1.83.1	1
quay.io/prometheus/prometheus :v3.13.2	508729e0e2d1	google.golang.org/grpc@v1.82.1	1.83.1	1
quay.io/prometheus/prometheus :v2.37.0	56e7f18e05dd	google.golang.org/grpc@v1.47.0	1.83.1	1
quay.io/prometheus/prometheus :v3.2.0	5888c188cf09	google.golang.org/grpc@v1.70.0	1.83.1	1
quay.io/prometheus/prometheus :v3.5.0	63805ebb8d2b	google.golang.org/grpc@v1.73.0	1.83.1	1
quay.io/prometheus/prometheus :v3.2.1	6927e0919a14	google.golang.org/grpc@v1.70.0	1.83.1	1
quay.io/prometheus/prometheus :v2.33.5	91100b06e86d	google.golang.org/grpc@v1.43.0	1.83.1	1
quay.io/prometheus/prometheus :v3.4.1	9abc6cf6aea7	google.golang.org/grpc@v1.72.0	1.83.1	1
quay.io/prometheus/prometheus :v2.34.0	b37103e03399	google.golang.org/grpc@v1.44.0	1.83.1	1
quay.io/prometheus/prometheus :v3.11.3	c0b857aead0d	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/prometheus/prometheus :v3.11.2	cd37346c9745	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/prometheus/prometheus :v2.53.1	f20d3127bf28	google.golang.org/grpc@v1.64.0	1.83.1	1
quay.io/rabbitmqoperator/cluster-operator :2.22.5	2727b84b835a	google.golang.org/grpc@v1.83.0	1.83.1	1
quay.io/rabbitmqoperator/messaging-topology-operator :1.20.2	29174b668012	google.golang.org/grpc@v1.83.0	1.83.1	1
quay.io/redhat-appstudio/appstudio-utils :dbbdd82734232e6289e8fbae5b4c858481a7c057	7b4202c25b67	google.golang.org/grpc@v1.46.0	1.83.1	1
quay.io/rhdh/rhdh-hub-rhel9 :latest	0b26358f5793	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	google.golang.org/grpc@v1.33.2	1.83.1	1
quay.io/skopeo/stable :v1.13	4853591bd1d2	google.golang.org/grpc@v1.55.0	1.83.1	1
quay.io/solo-io/certgen :0.0.0-fork	b17a8c7d1f32	google.golang.org/grpc@v1.40.0	1.83.1	1
quay.io/solo-io/discovery :0.0.0-fork	5b62aaade3c9	google.golang.org/grpc@v1.40.0	1.83.1	1