CVE-2026-84303: gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gRPC-Go (xDS RBAC HTTP filter)to a version that resolves this vulnerability.Fixed in 1.83.1
Event History
Frequently Asked Questions
Which deployments are exposed to the RBAC bypass?
Deployments using the gRPC-Go xDS RBAC HTTP filter before version 1.83.1 are exposed when they have DENY policies whose header matcher names use mixed case, such as X-Role or User-Agent. Incoming metadata keys are lowercase, so those policies do not match and fail open.
What does an attacker need to do to bypass an affected DENY rule?
An attacker only needs to send a request that would otherwise be rejected by a DENY policy relying on a mixed-case header matcher name. Because the incoming metadata key is lowercase and the configured matcher is not normalized, the rule fails to match.
Are there impacts beyond DENY-policy enforcement?
Yes. The same case mismatch can allow :Scheme or Grpc-Status to evade gRFC A41 validation, and it prevents Host from being rewritten to :authority.
What is the remediation?
Upgrade gRPC-Go to version 1.83.1, which fixes the header matcher normalization issue.