CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,305; of 17,813 indexed, latest versions
Container images: 2,756; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,305 of 17,813 indexed charts deploy, on 2,756 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,752
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,305 by stars

Chart

Latest

Affected images

Radar Score

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,526

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,756 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
registry.k8s.io/csi-vsphere/syncer :v3.4.0	179ebf195595	google.golang.org/grpc@v1.67.1	1.83.1	1
registry.k8s.io/csi-vsphere/syncer :v3.5.0	bb88468fff2a	google.golang.org/grpc@v1.68.1	1.83.1	1
registry.k8s.io/descheduler/descheduler :v0.36.0	7ca92c0a7b4f	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.k8s.io/dns/k8s-dns-node-cache :1.23.0	81a13703d6b8	google.golang.org/grpc@v1.56.3	1.83.1	1
registry.k8s.io/dns/k8s-dns-node-cache :1.26.7	8b9a78d101a1	google.golang.org/grpc@v1.75.1	1.83.1	1
registry.k8s.io/dns/k8s-dns-node-cache :1.23.1	e3dccb1a21d1	google.golang.org/grpc@v1.56.3	1.83.1	1
registry.k8s.io/e2e-test-images/agnhost :2.40	af7e3857d877	google.golang.org/grpc@v1.47.0	1.83.1	1
registry.k8s.io/etcd :3.6.4-0	e36c08168342	google.golang.org/grpc@v1.71.1	1.83.1	1
registry.k8s.io/kas-network-proxy/proxy-server :v0.0.37	c2f596cae3c6	google.golang.org/grpc@v1.40.0	1.83.1	1
registry.k8s.io/kube-apiserver :v1.25.0	f6902791fb9a	google.golang.org/grpc@v1.47.0	1.83.1	1
registry.k8s.io/kubebuilder/kube-rbac-proxy :v0.16.0	771a9a173e03	google.golang.org/grpc@v1.58.3	1.83.1	1
registry.k8s.io/kube-controller-manager :v1.25.0	66ce7d460e53	google.golang.org/grpc@v1.47.0	1.83.1	1
registry.k8s.io/kube-scheduler :v1.26.11	0684e23172d9	google.golang.org/grpc@v1.56.3	1.83.1	1
registry.k8s.io/kube-scheduler :v1.28.7	3ae5620a33bb	google.golang.org/grpc@v1.56.3	1.83.1	1
registry.k8s.io/kube-scheduler :v1.28.11	46cf7475c8da	google.golang.org/grpc@v1.56.3	1.83.1	1
registry.k8s.io/kube-scheduler :v1.25.0	9330c53feca7	google.golang.org/grpc@v1.47.0	1.83.1	1
registry.k8s.io/kwok/kwok :v0.8.0	6d25aa8fbdfe	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.k8s.io/metrics-server/metrics-server :v0.7.0	1c0419326500	google.golang.org/grpc@v1.59.0	1.83.1	1
registry.k8s.io/metrics-server/metrics-server :v0.7.1	db3800085a09	google.golang.org/grpc@v1.59.0	1.83.1	1
registry.k8s.io/nfd/node-feature-discovery :v0.16.6	19ebca8b3804	google.golang.org/grpc@v1.63.2	1.83.1	1
registry.k8s.io/node-problem-detector/node-problem-detector :v0.8.20	52f0618e9bc2	google.golang.org/grpc@v1.64.1	1.83.1	1
registry.k8s.io/node-problem-detector/node-problem-detector :v1.35.1	c380751accc5	google.golang.org/grpc@v1.77.0	1.83.1	1
registry.k8s.io/prometheus-adapter/prometheus-adapter :v0.11.1	e6a43c83ab16	google.golang.org/grpc@v1.53.0	1.83.1	1
registry.k8s.io/provider-os/cinder-csi-plugin :v1.36.0	78adaeb154c7	google.golang.org/grpc@v1.80.0	1.83.1	1
registry.k8s.io/provider-os/manila-csi-plugin :v1.36.0	190976e2e2fe	google.golang.org/grpc@v1.80.0	1.83.1	1
registry.k8s.io/provider-os/openstack-cloud-controller-manager :v1.36.0	e354e40db2d0	google.golang.org/grpc@v1.80.0	1.83.1	1
registry.k8s.io/sig-storage/csi-attacher :v4.1.0	08721106b949	google.golang.org/grpc@v1.51.0	1.83.1	1
registry.k8s.io/sig-storage/csi-attacher :v4.5.1	9dcd469f02bb	google.golang.org/grpc@v1.60.1	1.83.1	1
registry.k8s.io/sig-storage/csi-attacher :v4.10.0	be59d0556508	google.golang.org/grpc@v1.72.1	1.83.1	1
registry.k8s.io/sig-storage/csi-attacher :v3.5.0	dd245051317e	google.golang.org/grpc@v1.40.0	1.83.1	1
registry.k8s.io/sig-storage/csi-external-health-monitor-controller :v0.7.0	80b9ba94aa2a	google.golang.org/grpc@v1.48.0	1.83.1	1
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.9.1	2cddcc716c19	google.golang.org/grpc@v1.59.0	1.83.1	1
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.7.0	4a4cae5118c4	google.golang.org/grpc@v1.51.0	1.83.1	1
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.6.2	a13bff2ed69a	google.golang.org/grpc@v1.50.1	1.83.1	1
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.0.1	e07f914c32f0	google.golang.org/grpc@v1.27.0	1.83.1	1
registry.k8s.io/sig-storage/csi-provisioner :v5.0.2	7b9cdb5830d0	google.golang.org/grpc@v1.64.0	1.83.1	1
registry.k8s.io/sig-storage/csi-provisioner :v3.4.0	e468dddcd275	google.golang.org/grpc@v1.51.0	1.83.1	1
registry.k8s.io/sig-storage/csi-provisioner :v3.3.0	ee3b525d5b89	google.golang.org/grpc@v1.49.0	1.83.1	1
registry.k8s.io/sig-storage/csi-resizer :v1.13.1	2a0b297cc7c4	google.golang.org/grpc@v1.69.2	1.83.1	1
registry.k8s.io/sig-storage/csi-resizer :v1.7.0	3a7bdf5d1057	google.golang.org/grpc@v1.51.0	1.83.1	1
registry.k8s.io/sig-storage/csi-resizer :v1.6.0	425d8f1b7693	google.golang.org/grpc@v1.47.0	1.83.1	1
registry.k8s.io/sig-storage/csi-resizer :v2.0.0	4a95d94e57ad	google.golang.org/grpc@v1.72.1	1.83.1	1
registry.k8s.io/sig-storage/csi-resizer :v1.10.1	4ecda2818f6d	google.golang.org/grpc@v1.60.1	1.83.1	1
registry.k8s.io/sig-storage/csi-resizer :v1.3.0	6e0546563b18	google.golang.org/grpc@v1.38.0	1.83.1	1
registry.k8s.io/sig-storage/csi-resizer :v1.12.0	ab774734705a	google.golang.org/grpc@v1.65.0	1.83.1	1
registry.k8s.io/sig-storage/csi-snapshotter :v6.1.0	291334908ddf	google.golang.org/grpc@v1.47.0	1.83.1	1
registry.k8s.io/sig-storage/csi-snapshotter :v8.0.2	5f051159c95f	google.golang.org/grpc@v1.65.0	1.83.1	1
registry.k8s.io/sig-storage/csi-snapshotter :v8.2.1	5f4bb469fec5	google.golang.org/grpc@v1.69.0	1.83.1	1
registry.k8s.io/sig-storage/csi-snapshotter :v4.2.1	818f35653f2e	google.golang.org/grpc@v1.38.0	1.83.1	1
registry.k8s.io/sig-storage/csi-snapshotter :v5.0.1	89e900a160a9	google.golang.org/grpc@v1.40.0	1.83.1	1