CVE-2026-84303

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.003; 24th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,312; of 17,828 indexed, latest versions
Container images: 2,773; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Carried by container images the latest versions of 2,312 of 17,828 indexed charts deploy, on 2,773 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,769
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-qc2q-p7wx-3px3 UBUNTU-CVE-2026-84303
Also known as: GO-2026-6441

Charts affected

2,312 by stars

Chart

Latest

Affected images

Radar Score

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	google.golang.org/grpc@v1.81.0	1.83.1

Open the chart page →

1,061

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

13,934

xonodepoolsxonodepools

1.0.7

1 of 1 See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
xosphere/xonodepools :1.0.7	1458097b6f85	google.golang.org/grpc@v1.72.2	1.83.1

Open the chart page →

402

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.83.1

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

4,928

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.83.1

Open the chart page →

9,769

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,530

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,003

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84303.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,773 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/spiffe/spire-server :1.15.3	4082f30d3e0d	google.golang.org/grpc@v1.83.0	1.83.1	2
ghcr.io/squat/generic-device-plugin :36bfc606bba2064de6ede0ff2764cbb52edff70d	ba6f0b4cf6c8	google.golang.org/grpc@v1.56.3	1.83.1	2
ghcr.io/stashed/stash-ui-server :v0.23.0	47cffbc65700	google.golang.org/grpc@v1.62.1	1.83.1	2
ghcr.io/voyagermesh/gateway :v1.8.2	4237fd16a3cb	google.golang.org/grpc@v1.81.1	1.83.1	2
public.ecr.aws/cloudnatix/llmariner/api-usage-server :1.16.0	8f9c32b866b0	google.golang.org/grpc@v1.67.1	1.83.1	2
public.ecr.aws/cloudnatix/llmariner/cluster-manager-server :1.8.0	364b3ff0fcb7	google.golang.org/grpc@v1.68.1	1.83.1	2
public.ecr.aws/cloudnatix/llmariner/cluster-monitor-server :0.10.2	2d28f9e3eab4	google.golang.org/grpc@v1.73.0	1.83.1	2
public.ecr.aws/cloudnatix/llmariner/file-manager-server :1.11.0	301216788e93	google.golang.org/grpc@v1.67.0	1.83.1	2
public.ecr.aws/cloudnatix/llmariner/inference-manager-engine :1.46.0	c46f109c3d0b	google.golang.org/grpc@v1.79.3	1.83.1	2
public.ecr.aws/cloudnatix/llmariner/job-manager-dispatcher :1.27.0	582508903cb0	google.golang.org/grpc@v1.67.0	1.83.1	2
public.ecr.aws/cloudnatix/llmariner/job-manager-server :1.27.0	fe9de719f91e	google.golang.org/grpc@v1.67.0	1.83.1	2
public.ecr.aws/cloudnatix/llmariner/model-manager-loader :1.27.0	26ac7263a823	google.golang.org/grpc@v1.67.0	1.83.1	2
public.ecr.aws/cloudnatix/llmariner/model-manager-server :1.27.0	c057dcdd9ef3	google.golang.org/grpc@v1.67.0	1.83.1	2
public.ecr.aws/cloudnatix/llmariner/rbac-server :1.19.1	df1adeb86679	google.golang.org/grpc@v1.67.0	1.83.1	2
public.ecr.aws/cloudnatix/llmariner/user-manager-server :1.27.1	628a14449241	google.golang.org/grpc@v1.67.0	1.83.1	2
public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver :v1.16.1	1564359e1e0e	google.golang.org/grpc@v1.51.0	1.83.1	2
public.ecr.aws/eks-distro/etcd-io/etcd :v3.5.6-eks-1-24-7	efa6dee17ed2	google.golang.org/grpc@v1.41.0	1.83.1	2
public.ecr.aws/eks-distro/kubernetes-csi/external-attacher :v4.1.0-eks-1-25-latest	701eea03388c	google.golang.org/grpc@v1.51.0	1.83.1	2
public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner :v3.4.0-eks-1-25-latest	460ee1a59fea	google.golang.org/grpc@v1.51.0	1.83.1	2
public.ecr.aws/eks-distro/kubernetes-csi/external-resizer :v1.7.0-eks-1-25-latest	e711da25e7a0	google.golang.org/grpc@v1.51.0	1.83.1	2
public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe :v2.9.0-eks-1-25-latest	8a305e162caa	google.golang.org/grpc@v1.49.0	1.83.1	2
public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar :v2.7.0-eks-1-25-latest	f4345e67df8f	google.golang.org/grpc@v1.51.0	1.83.1	2
public.ecr.aws/p3k6k6h3/mdai-event-hub :0.1.11	18cae836e9c7	google.golang.org/grpc@v1.80.0	1.83.1	2
public.ecr.aws/p3k6k6h3/mdai-gateway :0.1.10	0dfb323978f6	google.golang.org/grpc@v1.80.0	1.83.1	2
quay.io/argoproj/argocd :v2.14.11	5fc69e31c755	google.golang.org/grpc@v1.65.0	1.83.1	2
quay.io/brancz/kube-rbac-proxy :v0.20.0	147cb28fea35	google.golang.org/grpc@v1.72.1	1.83.1	2
quay.io/brancz/kube-rbac-proxy :v0.14.1	58d91a5faaf8	google.golang.org/grpc@v1.47.0	1.83.1	2
quay.io/brancz/kube-rbac-proxy :v0.13.1	738c854322f5	google.golang.org/grpc@v1.47.0	1.83.1	2
quay.io/brancz/kube-rbac-proxy :v0.18.1	e6a323504999	google.golang.org/grpc@v1.65.0	1.83.1	2
quay.io/brancz/kube-rbac-proxy :v0.22.1	e8cad21b2f9a	google.golang.org/grpc@v1.80.0	1.83.1	2
quay.io/cephcsi/cephcsi :v3.17.1	0b62db8afc9b	google.golang.org/grpc@v1.81.0	1.83.1	2
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	google.golang.org/grpc@v1.48.0	1.83.1	2
quay.io/cilium/tetragon :v1.7.1	afc9458ba4bc	google.golang.org/grpc@v1.82.1	1.83.1	2
quay.io/cilium/tetragon-operator :v1.7.1	cd8b71f6860e	google.golang.org/grpc@v1.82.1	1.83.1	2
quay.io/coreos/etcd :v3.5.6	28cb0630cb85	google.golang.org/grpc@v1.41.0	1.83.1	2
quay.io/coreos/etcd :v3.7.1	3c66a5191d37	google.golang.org/grpc@v1.82.1	1.83.1	2
quay.io/coreos/etcd :v3.6.12	702d7b4881c6	google.golang.org/grpc@v1.79.3	1.83.1	2
quay.io/dexidp/dex :v2.24.0	c9b7f6d0d953	google.golang.org/grpc@v1.26.0	1.83.1	2
quay.io/groundcover/grafana :9.3.1	8c65b333a3d3	google.golang.org/grpc@v1.45.0	1.83.1	2
quay.io/iver-wharf/wharf-api :v5.2.0	b736b345437d	google.golang.org/grpc@v1.44.0	1.83.1	2
quay.io/iver-wharf/wharf-cmd :v0.8.2	e98d13459cdc	google.golang.org/grpc@v1.45.0	1.83.1	2
quay.io/iver-wharf/wharf-provider-gitlab :v2.0.1	d7079e0890da	google.golang.org/grpc@v1.44.0	1.83.1	2
quay.io/jetstack/cert-manager-controller :v1.17.2	2c314feeb5e8	google.golang.org/grpc@v1.69.2	1.83.1	2
quay.io/jetstack/cert-manager-controller :v1.14.3	64adcb95ce09	google.golang.org/grpc@v1.60.1	1.83.1	2
quay.io/jetstack/cert-manager-controller :v1.13.2	9c67cf8c92d8	google.golang.org/grpc@v1.58.3	1.83.1	2
quay.io/jetstack/cert-manager-controller :v1.11.0	d429b6d696e0	google.golang.org/grpc@v1.49.0	1.83.1	2
quay.io/jetstack/cert-manager-controller :v1.15.3	eee34b3de2dd	google.golang.org/grpc@v1.64.1	1.83.1	2
quay.io/jetstack/cert-manager-ctl :v1.11.0	74611761f052	google.golang.org/grpc@v1.49.0	1.83.1	2
quay.io/jetstack/cert-manager-webhook :v1.13.2	0a9470447ebf	google.golang.org/grpc@v1.58.3	1.83.1	2
quay.io/jetstack/cert-manager-webhook :v1.17.2	37b16a9dff00	google.golang.org/grpc@v1.69.2	1.83.1	2