CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,305; of 17,813 indexed, latest versions
Container images: 2,756; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,305 of 17,813 indexed charts deploy, on 2,756 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,752
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,305 by stars

Chart

Latest

Affected images

Radar Score

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,526

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,756 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/thanos/thanos :v0.17.1	e362f02ed304	google.golang.org/grpc@v1.29.1	1.83.1	1
quay.io/thanos/thanos :v0.36.1	e542959e1b36	google.golang.org/grpc@v1.63.2	1.83.1	1
quay.io/uswitch/kiam :v4.0	be3a5846922d	google.golang.org/grpc@v1.34.0	1.83.1	1
quay.io/zncdatadev/airflow-operator :0.4.0	b716ef483b75	google.golang.org/grpc@v1.72.2	1.83.1	1
quay.io/zncdatadev/commons-operator :0.4.0	1a353def9fe1	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/dolphinscheduler-operator :0.4.0	d0a4e55eeb7f	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/hbase-operator :0.4.0	69e9a1b0daf8	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/hdfs-operator :0.4.0	eb3c2928250e	google.golang.org/grpc@v1.72.2	1.83.1	1
quay.io/zncdatadev/hive-operator :0.4.0	d66ba9149c22	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/kafka-operator :0.4.0	0a0b4c39c1ba	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/listener-csi-driver :0.4.0	b69bed123b02	google.golang.org/grpc@v1.81.0	1.83.1	1
quay.io/zncdatadev/listener-operator :0.4.0	68b92dae8d75	google.golang.org/grpc@v1.81.0	1.83.1	1
quay.io/zncdatadev/nifi-operator :0.4.0	bb4e26ff5e2f	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/secret-csi-driver :0.4.0	604a7d98ab58	google.golang.org/grpc@v1.78.0	1.83.1	1
quay.io/zncdatadev/spark-k8s-operator :0.4.0	d3f2b10c4a6d	google.golang.org/grpc@v1.72.2	1.83.1	1
quay.io/zncdatadev/superset-operator :0.4.0	102e66e32218	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/trino-operator :0.4.0	4f516757aee3	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/zookeeper-operator :0.4.0	b4f33d89ac45	google.golang.org/grpc@v1.79.3	1.83.1	1
registry.gitlab.com/arm-research/smarter/smarter-device-manager :v1.20.11	826b984e75d4	google.golang.org/grpc@v1.49.0	1.83.1	1
registry.gitlab.com/arm-research/smarter/smarter-device-manager :v1.20.7	864fc338571e	google.golang.org/grpc@v1.37.1	1.83.1	1
registry.gitlab.com/bitspur/rock8s/images/kube-commands :3.18	80ef8ceffc92	google.golang.org/grpc@v1.54.0	1.83.1	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend :1.0.31	c7afac3446d6	google.golang.org/grpc@v1.79.1	1.83.1	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	google.golang.org/grpc@v1.79.1	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/certificates :v19.4.0	1c38ad710b0c	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitaly :v19.4.0	704cd68566af	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-base :v19.4.0	696d798a5c85	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry :v4.40.2-gitlab	dc1a8972c640	google.golang.org/grpc@v1.77.0	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter :17.0.2	6645e014f75d	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao :v2.5.5-gitlab2	5b7636dfba3f	google.golang.org/grpc@v1.80.0	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-shell :v14.57.3	aca1bb3d5b7e	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ee :v19.4.0	2256b49461fa	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	google.golang.org/grpc@v1.41.0	1.83.1	1
registry.gitlab.com/gitlab-org/gitlab-runner :alpine-v19.3.2	5448611a3c54	google.golang.org/grpc@v1.80.0	1.83.1	1
registry.gitlab.com/lenitech/k8s-operator/keycloak-client :v0.6.1	9065cdd80035	google.golang.org/grpc@v1.68.1	1.83.1	1
registry.gitlab.com/parrotsec/project/parrot-mirror-docker :main	f91b602ca572	google.golang.org/grpc@v1.56.2	1.83.1	1
registry.gitlab.com/shortlink-org/shortlink/bff :latest	f2194e526915	google.golang.org/grpc@v1.78.0	1.83.1	1
registry.gitlab.com/shortlink-org/shortlink/link :latest	86d87291ffd4	google.golang.org/grpc@v1.78.0	1.83.1	1
registry.gitlab.com/xrow-public/ci-tools/tools :main	9b9d1ed86b6a	google.golang.org/grpc@v1.82.1	1.83.1	1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller :2.1.2	301847adfe16	google.golang.org/grpc@v1.73.0	1.83.1	1
registry.gitlab.com/xrow-public/velero-client/velero-client :1.4.2	03015f863a3e	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.k8s.io/agent-sandbox/agent-sandbox-controller :v0.5.4	be477ba317d8	google.golang.org/grpc@v1.82.1	1.83.1	1
registry.k8s.io/agent-sandbox/agent-sandbox-controller :v0.5.6	dc23fb0d5624	google.golang.org/grpc@v1.83.0	1.83.1	1
registry.k8s.io/autoscaling/cluster-autoscaler :v1.33.0	6ef10d108e0e	google.golang.org/grpc@v1.68.1	1.83.1	1
registry.k8s.io/autoscaling/cluster-autoscaler :v1.34.0	7b172f42533c	google.golang.org/grpc@v1.72.1	1.83.1	1
registry.k8s.io/capi-operator/cluster-api-operator :v0.29.0	465e72f8b06a	google.golang.org/grpc@v1.82.1	1.83.1	1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere :v1.28.0	026f63d9ed42	google.golang.org/grpc@v1.54.0	1.83.1	1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere :v1.32.0	f9f4dfd733ab	google.golang.org/grpc@v1.65.0	1.83.1	1
registry.k8s.io/coredns/coredns :v1.13.2	94caebb89dcf	google.golang.org/grpc@v1.77.0	1.83.1	1
registry.k8s.io/csi-vsphere/driver :v3.5.0	4bb8350a5a62	google.golang.org/grpc@v1.68.1	1.83.1	1
registry.k8s.io/csi-vsphere/driver :v3.4.0	f5349a8ae3f3	google.golang.org/grpc@v1.67.1	1.83.1	1