CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,312; of 17,828 indexed, latest versions
Container images: 2,773; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,312 of 17,828 indexed charts deploy, on 2,773 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,769
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,312 by stars

Chart

Latest

Affected images

Radar Score

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	google.golang.org/grpc@v1.81.0	1.83.1

Open the chart page →

1,061

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

13,934

xonodepoolsxonodepools

1.0.7

1 of 1 See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
xosphere/xonodepools :1.0.7	1458097b6f85	google.golang.org/grpc@v1.72.2	1.83.1

Open the chart page →

402

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.83.1

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

4,928

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.83.1

Open the chart page →

9,769

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,530

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,003

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,773 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
neosmemo/memos :0.30.0	71a5b4738d1b	google.golang.org/grpc@v1.80.0	1.83.1	2
obolnetwork/charon :v1.10.0	278c7e2897b6	google.golang.org/grpc@v1.80.0	1.83.1	2
opencloudeu/opencloud-rolling :2.1.0	f9634bb04905	google.golang.org/grpc@v1.71.1	1.83.1	2
openebs/etcd :3.6.4-debian-12-r0	c86c06f1ce6a	google.golang.org/grpc@v1.71.1	1.83.1	2
openebs/provisioner-localpv :4.6.0	99f5116f5cb8	google.golang.org/grpc@v1.82.1	1.83.1	2
openpolicyagent/gatekeeper :v3.4.0-rc.1	825370bdb3c3	google.golang.org/grpc@v1.27.0	1.83.1	2
oryd/kratos :v1.0.0	d06fc5845f63	google.golang.org/grpc@v1.54.0	1.83.1	2
oryd/kratos :v1.3.1	fe2428f103a6	google.golang.org/grpc@v1.65.0	1.83.1	2
oryd/oathkeeper :v0.40.6	e8cb9b79a89c	google.golang.org/grpc@v1.56.1	1.83.1	2
otel/opentelemetry-collector-contrib :0.96.0	7ef2a2ff46b9	google.golang.org/grpc@v1.62.0	1.83.1	2
otel/opentelemetry-collector-contrib :0.145.0	a7343f018690	google.golang.org/grpc@v1.78.0	1.83.1	2
otel/opentelemetry-collector-k8s :0.111.0	32b3c8296dcc	google.golang.org/grpc@v1.67.1	1.83.1	2
place1/wg-access-server :v0.4.6	2b2f3ea80ed6	google.golang.org/grpc@v1.30.0	1.83.1	2
polyaxon/polyaxon-operator :2.17.0	7664c1cebb9d	google.golang.org/grpc@v1.68.1	1.83.1	2
prom/prometheus :v2.17.2	42d2395cd719	google.golang.org/grpc@v1.27.1	1.83.1	2
prom/prometheus :v2.52.0	5c435642ca4d	google.golang.org/grpc@v1.63.2	1.83.1	2
prom/prometheus :v2.37.9	8176adea328e	google.golang.org/grpc@v1.47.0	1.83.1	2
prom/prometheus :v2.48.1	a67e5e402ff5	google.golang.org/grpc@v1.58.3	1.83.1	2
prom/prometheus :v2.21.0	d43417c260e5	google.golang.org/grpc@v1.29.1	1.83.1	2
prom/prometheus :v2.16.0	e4ca62c0d62f	google.golang.org/grpc@v1.22.1	1.83.1	2
qingcloud/hostnic-plus :v1.0.3	4cd5366a9f51	google.golang.org/grpc@v1.27.1	1.83.1	2
rancher/k3s :v1.26.0-k3s1	9380f5dbae9a	google.golang.org/grpc@v1.50.1	1.83.1	2
rancher/kine :v0.11.4	12889bbcd1e8	google.golang.org/grpc@v1.56.3	1.83.1	2
rclone/rclone :1.68	74c51b8817e5	google.golang.org/grpc@v1.64.1	1.83.1	2
rookout/controller :latest	4451a6f6b8ec	google.golang.org/grpc@v1.57.0	1.83.1	2
rookout/data-on-prem :latest	51c0fce64467	google.golang.org/grpc@v1.57.0	1.83.1	2
scaleway/cert-manager-webhook-scaleway :v0.0.1	dcc14608d000	google.golang.org/grpc@v1.27.0	1.83.1	2
squareup/ghostunnel :v1.5.2	70f4cf270425	google.golang.org/grpc@v1.24.0	1.83.1	2
statping/statping :v0.90.74	e874da513a5c	google.golang.org/grpc@v1.28.1	1.83.1	2
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	google.golang.org/grpc@v1.45.0	1.83.1	2
temporalio/admin-tools :1.15.1	35034611d981	google.golang.org/grpc@v1.44.0	1.83.1	2
temporalio/server :1.22.4	c0a44c26397b	google.golang.org/grpc@v1.59.0	1.83.1	2
temporalio/server :1.15.1	e26758f5a1bf	google.golang.org/grpc@v1.44.0	1.83.1	2
temporalio/ui :2.16.2	af9c9349708f	google.golang.org/grpc@v1.55.0	1.83.1	2
testinprod/op-erigon :latest	0a125bd77a2d	google.golang.org/grpc@v1.63.2	1.83.1	2
thesisrobot/loop :v0.11.1-beta	89ae07e787ca	google.golang.org/grpc@v1.24.0	1.83.1	2
thesisrobot/pool :v0.3.3-alpha	2d1c388a4bda	google.golang.org/grpc@v1.29.1	1.83.1	2
tykio/tyk-mdcb-docker :v2.12.0	942a5b8bf847	google.golang.org/grpc@v1.80.0	1.83.1	2
ubercadence/server :0.23.2	2ac5491d13bb	google.golang.org/grpc@v1.29.1	1.83.1	2
uselagoon/docker-host :v3.6.1	2c89ed939b8b	google.golang.org/grpc@v1.69.4	1.83.1	2
voltha/voltha-ofagent-go :2.1.6	8feb9ef89e97	google.golang.org/grpc@v1.25.1	1.83.1	2
voltha/voltha-openolt-adapter :4.5.16	d6d79c08350a	google.golang.org/grpc@v1.25.1	1.83.1	2
voltha/voltha-openonu-adapter-go :2.12.25	d8f2eb5f2a7e	google.golang.org/grpc@v1.25.1	1.83.1	2
voltha/voltha-rw-core :3.4.8	7a325316fe59	google.golang.org/grpc@v1.25.1	1.83.1	2
xelalex/dregsy :0.4.3	574054e1c417	google.golang.org/grpc@v1.44.0	1.83.1	2
zhenghaoz/gorse-master :0.4.12	033046b432ec	google.golang.org/grpc@v1.50.1	1.83.1	2
zhenghaoz/gorse-server :0.4.12	39c565685b01	google.golang.org/grpc@v1.50.1	1.83.1	2
zhenghaoz/gorse-worker :0.4.12	f7739f64c9b0	google.golang.org/grpc@v1.50.1	1.83.1	2
gcr.io/k8s-staging-sig-storage/csi-provisioner :v3.2.1	4ad5fcdbe7e9	google.golang.org/grpc@v1.45.0	1.83.1	2
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller	0d5f740b4224	google.golang.org/grpc@v1.71.1	1.83.1	2