CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,312; of 17,828 indexed, latest versions
Container images: 2,773; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,312 of 17,828 indexed charts deploy, on 2,773 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,769
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,312 by stars

Chart

Latest

Affected images

Radar Score

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	google.golang.org/grpc@v1.81.0	1.83.1

Open the chart page →

1,061

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

13,934

xonodepoolsxonodepools

1.0.7

1 of 1 See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
xosphere/xonodepools :1.0.7	1458097b6f85	google.golang.org/grpc@v1.72.2	1.83.1

Open the chart page →

402

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.83.1

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

4,928

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.83.1

Open the chart page →

9,769

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,530

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,003

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,773 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook	697668be7893	google.golang.org/grpc@v1.71.1	1.83.1	2
gcr.io/knative-releases/knative.dev/serving/cmd/activator	031408ec516f	google.golang.org/grpc@v1.71.1	1.83.1	2
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	3502bb5aa60f	google.golang.org/grpc@v1.71.1	1.83.1	2
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler-hpa	7405faeb7636	google.golang.org/grpc@v1.71.1	1.83.1	2
gcr.io/knative-releases/knative.dev/serving/cmd/controller	5b93308a392c	google.golang.org/grpc@v1.71.1	1.83.1	2
gcr.io/knative-releases/knative.dev/serving/cmd/webhook	50831d9aaa69	google.golang.org/grpc@v1.71.1	1.83.1	2
ghcr.io/alpineworks/flux-suspension-exporter :v1.0.0	341f0a6cd2b6	google.golang.org/grpc@v1.70.0	1.83.1	2
ghcr.io/appscode/fargocd :v0.1.0	c59d775d9a7c	google.golang.org/grpc@v1.79.3	1.83.1	2
ghcr.io/appscode/grafana-tools :v0.8.0	77c9d29080eb	google.golang.org/grpc@v1.79.3	1.83.1	2
ghcr.io/appscode/grafana-tools :v0.0.1	f60324bca644	google.golang.org/grpc@v1.47.0	1.83.1	2
ghcr.io/appscode/kube-rbac-proxy :v0.11.0	0df4ae70e3bd	google.golang.org/grpc@v1.27.0	1.83.1	2
ghcr.io/appscode/service-provider :v0.0.2	f6e481386d70	google.golang.org/grpc@v1.72.1	1.83.1	2
ghcr.io/astriaorg/astria-geth :latest	4249e403225a	google.golang.org/grpc@v1.64.1	1.83.1	2
ghcr.io/bank-vaults/vault-operator :v1.24.0	6f622c5fb8a9	google.golang.org/grpc@v1.81.1	1.83.1	2
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	google.golang.org/grpc@v1.68.1	1.83.1	2
ghcr.io/buoyantio/prometheus :v2.55.1	2659f4c2ebb7	google.golang.org/grpc@v1.66.0	1.83.1	2
ghcr.io/celestiaorg/celestia-node :v0.27.5-mocha	4768ea1c5fd2	google.golang.org/grpc@v1.75.1	1.83.1	2
ghcr.io/chaos-mesh/chaos-coredns :v0.2.8	38bfdf5e3774	google.golang.org/grpc@v1.29.1	1.83.1	2
ghcr.io/chaos-mesh/chaos-coredns :v0.2.6	78dc63bc5b89	google.golang.org/grpc@v1.29.1	1.83.1	2
ghcr.io/cloudnative-pg/cloudnative-pg :1.25.1	b5210df46c05	google.golang.org/grpc@v1.70.0	1.83.1	2
ghcr.io/containerd/nydus-snapshotter :v0.9.0	56f8617363b4	google.golang.org/grpc@v1.53.0	1.83.1	2
ghcr.io/cosmos/gaia :v25.1.0	f115777d1112	google.golang.org/grpc@v1.72.2	1.83.1	2
ghcr.io/dexidp/dex :v2.28.1	5e88f2205de1	google.golang.org/grpc@v1.34.0	1.83.1	2
ghcr.io/glassflow/glassflow-etl-k8s-operator :v3.2.1	e70364e88629	google.golang.org/grpc@v1.75.0	1.83.1	2
ghcr.io/google/fleetspeak :v0.1.17	cd264d33efd4	google.golang.org/grpc@v1.64.0	1.83.1	2
ghcr.io/headlamp-k8s/headlamp :v0.45.0	db3f0e0fc58d	google.golang.org/grpc@v1.82.1	1.83.1	2
ghcr.io/juanfont/headscale :0.29.3 :v0.29.3	0e7f1c6e4ce6	google.golang.org/grpc@v1.81.1	1.83.1	2
ghcr.io/juniorjpdj/containers/openssl-kubectl :1.36.1-r4	7d576be7f838	google.golang.org/grpc@v1.79.3	1.83.1	2
ghcr.io/k8snetworkplumbingwg/multus-cni :v4.1.4	09fdfb7ce090	google.golang.org/grpc@v1.58.3	1.83.1	2
ghcr.io/keptn/lifecycle-operator :v2.0.0	866ced256a8c	google.golang.org/grpc@v1.68.0	1.83.1	2
ghcr.io/keptn/metrics-operator :v2.1.0	dc48471c7cf8	google.golang.org/grpc@v1.68.0	1.83.1	2
ghcr.io/konpyutaika/docker-images/nifikop :v1.14.1-release	6bb00c592a82	google.golang.org/grpc@v1.65.0	1.83.1	2
ghcr.io/kubedb/kubedb-provisioner :v0.66.0	824d6d78d451	google.golang.org/grpc@v1.79.3	1.83.1	2
ghcr.io/kubedb/kubedb-provisioner :v0.66.0	e7041c3b41e7	google.golang.org/grpc@v1.79.3	1.83.1	2
ghcr.io/matrix-org/sliding-sync :v0.99.19	b940cab56435	google.golang.org/grpc@v1.58.3	1.83.1	2
ghcr.io/nucleuscloud/neosync/api :0.5.41	e2abb798f29f	google.golang.org/grpc@v1.71.0	1.83.1	2
ghcr.io/nucleuscloud/neosync/worker :0.5.41	96f42450c5b1	google.golang.org/grpc@v1.71.0	1.83.1	2
ghcr.io/parca-dev/parca :v0.20.0	0d1df8f436f7	google.golang.org/grpc@v1.55.0	1.83.1	2
ghcr.io/projectcapsule/capsule :v0.14.6	ac02588e65e8	google.golang.org/grpc@v1.83.0	1.83.1	2
ghcr.io/quenchworks/images/coolify-realtime	f128e512c9c0	google.golang.org/grpc@v1.82.1	1.83.1	2
ghcr.io/quenchworks/images/prometheus	e9037c190bc1	google.golang.org/grpc@v1.82.1	1.83.1	2
ghcr.io/quenchworks/images/tempo	9e889ec33f96	google.golang.org/grpc@v1.82.1	1.83.1	2
ghcr.io/rabbitmq/messaging-topology-operator :1.19.1	24c4649ef3ef	google.golang.org/grpc@v1.80.0	1.83.1	2
ghcr.io/sigstore/fulcio :v1.8.8	ef72cf56c64b	google.golang.org/grpc@v1.81.1	1.83.1	2
ghcr.io/sigstore/rekor/rekor-server :v1.5.4	100d793d68d0	google.golang.org/grpc@v1.82.1	1.83.1	2
ghcr.io/smarter-project/smarter-device-manager :v1.20.12	228f7f44594a	google.golang.org/grpc@v1.51.0	1.83.1	2
ghcr.io/spiffe/oidc-discovery-provider :1.15.3	bb95f13c2b4e	google.golang.org/grpc@v1.83.0	1.83.1	2
ghcr.io/spiffe/spiffe-csi-driver :0.2.7	9dfe4f0caff0	google.golang.org/grpc@v1.71.0	1.83.1	2
ghcr.io/spiffe/spiffe-helper :0.11.0	1c92e5998ad3	google.golang.org/grpc@v1.76.0	1.83.1	2
ghcr.io/spiffe/spire-controller-manager :0.7.0	d7b9e710f542	google.golang.org/grpc@v1.82.1	1.83.1	2