CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,312; of 17,828 indexed, latest versions
Container images: 2,773; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,312 of 17,828 indexed charts deploy, on 2,773 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,769
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,312 by stars

Chart

Latest

Affected images

Radar Score

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	google.golang.org/grpc@v1.81.0	1.83.1

Open the chart page →

1,061

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

13,934

xonodepoolsxonodepools

1.0.7

1 of 1 See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
xosphere/xonodepools :1.0.7	1458097b6f85	google.golang.org/grpc@v1.72.2	1.83.1

Open the chart page →

402

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.83.1

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

4,928

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.83.1

Open the chart page →

9,769

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,530

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,003

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,773 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
grafana/tempo :2.10.8	f0561deb1c68	google.golang.org/grpc@v1.82.1	1.83.1	2
hanchuanchuan/goinception :latest	b3c0dd26fb50	google.golang.org/grpc@v1.29.1	1.83.1	2
hashicorp/boundary-enterprise :1.0.1-ent	38d2f9bdee0d	google.golang.org/grpc@v1.79.3	1.83.1	2
hashicorp/consul :1.14.2	e38576edcdfd	google.golang.org/grpc@v1.49.0	1.83.1	2
hashicorp/consul-k8s-control-plane :1.0.2	538a3436398d	google.golang.org/grpc@v1.19.0	1.83.1	2
hashicorp/vault :1.8.3	4db614d40d0e	google.golang.org/grpc@v1.29.1	1.83.1	2
hashicorp/vault :1.15.2	6b4e5dadf082	google.golang.org/grpc@v1.58.3	1.83.1	2
hashicorp/vault :1.12.1	8de4d5f31b38	google.golang.org/grpc@v1.47.0	1.83.1	2
hetznercloud/hcloud-cloud-controller-manager :v1.37.0	c139e7220dbc	google.golang.org/grpc@v1.79.3	1.83.1	2
hoppscotch/hoppscotch :2024.8.2	f1da831950b7	google.golang.org/grpc@v1.59.0	1.83.1	2
ilum/api :6.7.3	624fd09528c8	google.golang.org/grpc@v1.65.0	1.83.1	2
inaccel/daemon :latest	093e1ea90ab8	google.golang.org/grpc@v1.61.0	1.83.1	2
iomesh/csi-node-driver-registrar :v2.5.0	86f58b0a2106	google.golang.org/grpc@v1.40.0	1.83.1	2
iomesh/csi-provisioner :v3.0.0	f9508460b273	google.golang.org/grpc@v1.38.0	1.83.1	2
iomesh/csi-snapshotter :v6.2.2	becc53e25b96	google.golang.org/grpc@v1.50.1	1.83.1	2
iomesh/livenessprobe :v2.8.0	560f01510f99	google.golang.org/grpc@v1.48.0	1.83.1	2
iomesh/localpv-manager :v0.2.0	f13deacac3f4	google.golang.org/grpc@v1.50.0	1.83.1	2
ipfs/ipfs-cluster :latest :v1.1.6	a83266c524f1	google.golang.org/grpc@v1.81.0	1.83.1	2
ipfs/kubo :v0.33.2	1a30f5ed8579	google.golang.org/grpc@v1.67.1	1.83.1	2
istio/install-cni :1.24.2-distroless	aef4825e110f	google.golang.org/grpc@v1.67.1	1.83.1	2
istio/pilot :1.24.2-distroless	137e44e3d1d2	google.golang.org/grpc@v1.67.1	1.83.1	2
istio/proxyv2 :1.18.0	757d28c24100	google.golang.org/grpc@v1.54.0	1.83.1	2
istio/proxyv2 :1.10.3	a78b7a165744	google.golang.org/grpc@v1.36.0	1.83.1	2
jaegertracing/all-in-one :1.31	04d224a9999b	google.golang.org/grpc@v1.44.0	1.83.1	2
juicedata/csi-dashboard :v0.33.0	5e5edb62a010	google.golang.org/grpc@v1.82.1	1.83.1	2
juicedata/juicefs-csi-driver :v0.33.0	f918e7331c05	google.golang.org/grpc@v1.80.0	1.83.1	2
k0sproject/k0s :v1.26.0-k0s.0	f04635825d51	google.golang.org/grpc@v1.51.0	1.83.1	2
kong/kubernetes-ingress-controller :3.5	979f12864a13	google.golang.org/grpc@v1.82.1	1.83.1	2
kurento/kurento-media-server :latest	03c0d34d0828	grpc@1.51.1-4.1build5	no fix listed	2
library/caddy :2.11.4-alpine :2-alpine	de23def33b17	google.golang.org/grpc@v1.81.0	1.83.1	2
library/caddy :latest	df7f1c2fb114	google.golang.org/grpc@v1.81.0	1.83.1	2
library/influxdb :2.6.1-alpine	44a366dd7724	google.golang.org/grpc@v1.47.0	1.83.1	2
library/influxdb :2.7	b8d940ca9376	google.golang.org/grpc@v1.64.1	1.83.1	2
library/traefik :v3.7.1	6b9cbca6fac4	google.golang.org/grpc@v1.80.0	1.83.1	2
library/traefik :v2.5	7d5a6ae66572	google.golang.org/grpc@v1.38.0	1.83.1	2
library/traefik :2.4.8	eda951fd29a8	google.golang.org/grpc@v1.27.1	1.83.1	2
library/traefik :2.2.8	f5af5a5ce17f	google.golang.org/grpc@v1.27.1	1.83.1	2
lightninglabs/lnd :v0.18.3-beta	f86bbec4dfb3	google.golang.org/grpc@v1.59.0	1.83.1	2
linuxserver/cloud9 :latest :version-1.29.2	45c5fe102ff3	google.golang.org/grpc@v1.43.0	1.83.1	2
linuxserver/wireguard :1.0.20260223-r0-ls122 :latest	dca67384e3e9	google.golang.org/grpc@v1.77.0	1.83.1	2
longhornio/longhorn-manager :v1.12.1	83b79f57043f	google.golang.org/grpc@v1.83.0	1.83.1	2
longhornio/longhorn-manager :v1.2.3	dca34321452c	google.golang.org/grpc@v1.26.0	1.83.1	2
longhornio/longhorn-share-manager :v1.12.1	efaf47aeb4e8	google.golang.org/grpc@v1.82.1	1.83.1	2
louislam/uptime-kuma :2.5.4	917318f9d7be	google.golang.org/grpc@v1.79.2	1.83.1	2
louislam/uptime-kuma :2.3.2	9aeb4e51d038	google.golang.org/grpc@v1.72.2	1.83.1	2
louislam/uptime-kuma :2.5.0	a8610b3b4c38	google.golang.org/grpc@v1.79.2	1.83.1	2
mattermost/mattermost-team-edition :10.11.2	b8bd1246cb3a	google.golang.org/grpc@v1.72.0	1.83.1	2
migrate/migrate :latest	76cc2074cb66	google.golang.org/grpc@v1.82.0	1.83.1	2
migrate/migrate :latest	cc4ad8e19d66	google.golang.org/grpc@v1.74.2	1.83.1	2
moby/buildkit :v0.32.2-rootless	504731e577c2	google.golang.org/grpc@v1.82.1	1.83.1	2