StackRadar

CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,305
of 17,813 indexed, latest versions
Container images
2,756
deployed by those charts
Fix available
1 of 2
affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,305 of 17,813 indexed charts deploy, on 2,756 images.

Affected packageAffected versionsFixed inImages
google.golang.org/grpcgolangv0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more1.83.12,752
grpcdeb1.16.1-1ubuntu5, 1.51.1-4.1build5no fix listed4
OSV records
GHSA-qc2q-p7wx-3px3UBUNTU-CVE-2026-84303
Also known as
GO-2026-6441

Charts affected

2,305 by stars
ChartLatestAffected imagesRadar Score
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
google.golang.org/grpc@v1.79.2
1.83.1

Open the chart page →

30,899
runwhen-localrunwhen-contribVerified publisher0.6.171 of 3See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
otel/opentelemetry-collector:0.153.06ed874ea083d
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

3,842
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
google.golang.org/grpc@v1.75.0
1.83.1

Open the chart page →

6,225
orbitalryuunosukeds30.2.01 of 1See more

orbital ryuunosukeds3 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
ryuunosukeds3/orbital:latest0879f7261b10
google.golang.org/grpc@v1.70.0
1.83.1

Open the chart page →

2,706
caddysagikazarmarkVerified publisher0.0.141 of 1See more

caddy sagikazarmark 0.0.14

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
library/caddy:2.4.5874405536b3e
google.golang.org/grpc@v1.38.0
1.83.1

Open the chart page →

2,979
tusdsagikazarmarkVerified publisher0.1.21 of 1See more

tusd sagikazarmark 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
tusproject/tusd:v1.10.01e457b59fd5b
google.golang.org/grpc@v1.50.0
1.83.1

Open the chart page →

1,553
knative-helm-operatorsalaboy1.9.01 of 2See more

knative-helm-operator salaboy 1.9.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
gcr.io/knative-releases/knative.dev/operator/cmd/webhookdigest-pinned6c5c90cdf707
google.golang.org/grpc@v1.47.0
1.83.1

Open the chart page →

2,346
saml-exportersaml-exporter0.5.01 of 2See more

saml-exporter saml-exporter 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/brancz/kube-rbac-proxy:v0.19.19f21034731c7
google.golang.org/grpc@v1.65.0
1.83.1

Open the chart page →

1,522
speedtestsantisbon0.1.02 of 3See more

speedtest santisbon 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
google.golang.org/grpc@v1.81.1
1.83.1
library/influxdb:2.7b8d940ca9376
google.golang.org/grpc@v1.64.1
1.83.1

Open the chart page →

12,923
uptime-kumasarab97Verified publisher0.1.51 of 1See more

uptime-kuma sarab97 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.22.10b55bcb83a1c
google.golang.org/grpc@v1.51.0
1.83.1

Open the chart page →

4,796
grafanasb-helm-charts0.4.01 of 1See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:12.2.22ebef928d7e5
google.golang.org/grpc@v1.74.2
1.83.1

Open the chart page →

1,832
harborsb-helm-charts0.3.01 of 2See more

harbor sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.11.1c017dd84ee96
google.golang.org/grpc@v1.63.2
1.83.1

Open the chart page →

1,695
lokisb-helm-charts0.4.01 of 1See more

loki sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/loki:3.6.192bd5700577b
google.golang.org/grpc@v1.75.1
1.83.1

Open the chart page →

828
mimirsb-helm-charts0.3.01 of 1See more

mimir sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/mimir:2.15.085f55510e0d3
google.golang.org/grpc@v1.65.0
1.83.1

Open the chart page →

895
opentelemetry-collectorsb-helm-charts0.3.01 of 1See more

opentelemetry-collector sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
google.golang.org/grpc@v1.62.0
1.83.1

Open the chart page →

1,742
promtailsb-helm-charts0.4.01 of 1See more

promtail sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/promtail:3.6.18dcfdf466da0
google.golang.org/grpc@v1.75.1
1.83.1

Open the chart page →

2,295
temposb-helm-charts0.4.01 of 1See more

tempo sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/tempo:2.9.065a578975943
google.golang.org/grpc@v1.75.0
1.83.1

Open the chart page →

948
thanos-compactorsb-helm-charts0.3.01 of 1See more

thanos-compactor sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
google.golang.org/grpc@v1.63.2
1.83.1

Open the chart page →

978
thanos-querysb-helm-charts0.3.01 of 1See more

thanos-query sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
google.golang.org/grpc@v1.63.2
1.83.1

Open the chart page →

978
thanos-query-frontendsb-helm-charts0.3.01 of 1See more

thanos-query-frontend sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
google.golang.org/grpc@v1.63.2
1.83.1

Open the chart page →

978
thanos-receivesb-helm-charts0.3.01 of 1See more

thanos-receive sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
google.golang.org/grpc@v1.63.2
1.83.1

Open the chart page →

978
thanos-rulersb-helm-charts0.3.01 of 1See more

thanos-ruler sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
google.golang.org/grpc@v1.63.2
1.83.1

Open the chart page →

978
thanos-sidecarsb-helm-charts0.3.01 of 1See more

thanos-sidecar sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
google.golang.org/grpc@v1.63.2
1.83.1

Open the chart page →

978
thanos-storesb-helm-charts0.3.01 of 1See more

thanos-store sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
google.golang.org/grpc@v1.63.2
1.83.1

Open the chart page →

978
ed-traefikscaleway-charts0.2.01 of 1See more

ed-traefik scaleway-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
library/traefik:v1.7.345d47b7bb2546
google.golang.org/grpc@v1.38.0
1.83.1

Open the chart page →

2,141
ed-traefik2scaleway-charts0.2.01 of 1See more

ed-traefik2 scaleway-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
library/traefik:2.5.62f603f8d3abe
google.golang.org/grpc@v1.38.0
1.83.1

Open the chart page →

3,169
scaleway-certmanager-webhookscaleway-charts0.4.31 of 1See more

scaleway-certmanager-webhook scaleway-charts 0.4.3

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
scaleway/cert-manager-webhook-scaleway:v0.1.36d94c970e710
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

146
scaleway-secrets-store-csiscaleway-charts0.1.11 of 1See more

scaleway-secrets-store-csi scaleway-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
scaleway/scaleway-secrets-store-csi:v0.1.19acc53a69962
google.golang.org/grpc@v1.83.0
1.83.1

Open the chart page →

243
cert-manager-webhook-cloudnsschichtelVerified publisher1.2.01 of 1See more

cert-manager-webhook-cloudns schichtel 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
ghcr.io/pschichtel/cert-manager-webhook-cloudns:1.1.01020638bbe23
google.golang.org/grpc@v1.60.1
1.83.1

Open the chart page →

1,411
s3-backupschichtelVerified publisher0.10.01 of 1See more

s3-backup schichtel 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
ghcr.io/pschichtel/s3-backup:0.7.017666811f6a7
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

2,418
cert-manager-desec-webhookschmitzis0.0.11 of 1See more

cert-manager-desec-webhook schmitzis 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
su541/cert-manager-desec-webhook:latest371ee33f83c1
google.golang.org/grpc@v1.51.0
1.83.1

Open the chart page →

1,785
cert-manager-webhook-bunnyschmitzis0.1.11 of 1See more

cert-manager-webhook-bunny schmitzis 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
ghcr.io/schmitzis/cert-manager-webhook-bunny:latest125e31c8e85a
google.golang.org/grpc@v1.51.0
1.83.1

Open the chart page →

1,513
icinga2-masterschmitzis0.2.01 of 6See more

icinga2-master schmitzis 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:8.0.3696823fbc561
google.golang.org/grpc@v1.37.1
1.83.1

Open the chart page →

3,740
cernboxsciencebox0.0.41 of 6See more

cernbox sciencebox 0.0.4

1 of the 6 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
cs3org/revad:v1.19.03b57a34a7dfd
google.golang.org/grpc@v1.47.0
1.83.1

Open the chart page →

2,340
centralbrainsciencemeshVerified publisher0.0.32 of 5See more

centralbrain sciencemesh 0.0.3

2 of the 5 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:7.3.315b977f5207d
google.golang.org/grpc@v1.30.0
1.83.1
quay.io/prometheus/prometheus:v2.22.1b899dbd1b901
google.golang.org/grpc@v1.32.0
1.83.1

Open the chart page →

9,774
hermitcrabseal-ioVerified publisher0.1.41 of 2See more

hermitcrab seal-io 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
sealio/terraform-deployer:v1.5.7-seal.1b0389d9848a5
google.golang.org/grpc@v1.53.0
1.83.1

Open the chart page →

4,892
seaweedfs-operatorseaweedfs-operatorVerified publisher1.5.81 of 3See more

seaweedfs-operator seaweedfs-operator 1.5.8

1 of the 3 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
ghcr.io/nnstd/seaweedfs-operator:1.43ebe2fd253f6
google.golang.org/grpc@v1.73.0
1.83.1

Open the chart page →

2,099
secrets-bridgesecrets-bridge0.2.01 of 1See more

secrets-bridge secrets-bridge 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
ghcr.io/haydercyber/secrets-bridge:0.2.04709f1bb3039
google.golang.org/grpc@v1.65.0
1.83.1

Open the chart page →

387
aws-secretssecretsprovider0.1.01 of 1See more

aws-secrets secretsprovider 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws:1.0.r1-10-g1942553-2021.06.04.00.07-linux-amd64b32c99e7bc45
google.golang.org/grpc@v1.35.0
1.83.1

Open the chart page →

2,221
secretssecrets-proxy1.0.61 of 1See more

secrets secrets-proxy 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
udhos/secrets:1.0.6daa2b4eaac09
google.golang.org/grpc@v1.71.1
1.83.1

Open the chart page →

1,150
cloudflaredsectionmeVerified publisher2022.3.41 of 1See more

cloudflared sectionme 2022.3.4

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/giantswarm/cloudflared:2022.3.40b20d2fe9a6b
google.golang.org/grpc@v1.43.0
1.83.1

Open the chart page →

2,441
trivysecurecodebox-trivy5.9.01 of 1See more

trivy securecodebox-trivy 5.9.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
aquasec/trivy:0.74.062b1e65e8869
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

447
seldon-core-analyticsseldon1.17.12 of 8See more

seldon-core-analytics seldon 1.17.1

2 of the 8 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:7.0.3d72946c8e5d5
google.golang.org/grpc@v1.27.1
1.83.1
prom/prometheus:v2.18.15880ec936055
google.golang.org/grpc@v1.29.0
1.83.1

Open the chart page →

10,752
semaphoresemaphore-light1.0.01 of 1See more

semaphore semaphore-light 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
semaphoreui/semaphore:latest3996804607eb
google.golang.org/grpc@v1.76.0
1.83.1

Open the chart page →

1,869
cortezasergiotocaliniVerified publisher1.0.11 of 1See more

corteza sergiotocalini 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
cortezaproject/corteza:2024.9.60bcdcbcd3c63
google.golang.org/grpc@v1.61.1
1.83.1

Open the chart page →

3,355
miniosergiotocaliniVerified publisher1.0.01 of 1See more

minio sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-07-21T21-12-44Z8e5e9490cd50
google.golang.org/grpc@v1.54.0
1.83.1

Open the chart page →

4,352
rdpgwsergiotocaliniVerified publisher1.0.01 of 1See more

rdpgw sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
bolkedebruin/rdpgw:masterc0dc0589373a
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

687
service-exampleservice-example-jt0.1.11 of 9See more

service-example service-example-jt 0.1.1

1 of the 9 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
bitnami/mongodb-exporter:latestf7034c13af4e
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

7,598
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
google.golang.org/grpc@v1.76.0
1.83.1

Open the chart page →

7,746
bffshortlink0.2.11 of 1See more

bff shortlink 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
google.golang.org/grpc@v1.78.0
1.83.1

Open the chart page →

1,699

Container images carrying it

2,756 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/hostpathplugin:v1.9.092257881c1d6
google.golang.org/grpc@v1.34.0
1.83.1
1
registry.k8s.io/sig-storage/livenessprobe:v2.9.02b10b24dafdc
google.golang.org/grpc@v1.49.0
1.83.1
1
registry.k8s.io/sig-storage/livenessprobe:v2.11.082adbebdf5d5
google.golang.org/grpc@v1.58.0
1.83.1
1
registry.k8s.io/sig-storage/nfsplugin:v4.13.41eb5a85180a4
google.golang.org/grpc@v1.79.3
1.83.1
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
google.golang.org/grpc@v1.71.0
1.83.1
1
registry.k8s.io/sig-storage/objectstorage-sidecar:v0.2.2c7166a73a303
google.golang.org/grpc@v1.74.2
1.83.1
1

syft 1.42.1 · advisories as of 20 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.