CVE-2026-84303: gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
Summary A vulnerability in the xDS RBAC HTTP filter implementation in grpc-go allows remote attackers to bypass authorization policies (specifically DENY rules) by using mixed-case or canonical-case header matchers (e.g., X-Role instead of x-role). Additionally, the safety guards introduced by gRFC A41 to block grpc- prefixed headers can be evaded via variations in casing (e.g., Grpc-Status).
Impact When an operator defines an RBAC policy referencing headers containing uppercase letters (e.g. X-Role), grpc-go fails to match incoming metadata keys because they are unconditionally lowercased. Because of this case-sensitivity mismatch, a policy designed to block requests containing specific header values fails open: the rule is evaluated as a non-match, and traffic that should have been rejected is served.
Furthermore, gRFC A41 requires rejecting configuration schemas specifying header matchers starting with grpc-. Because this check is executed case-sensitively in grpc-go, attackers can bypass the validation by specifying titles like Grpc-Status.
Patches The problem is fixed in master and in the 1.83.1 release.
Other sources
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.
— NVD
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/google.golang.org/grpcto a version that resolves this vulnerability.Fixed in 1.83.1 - Upgrade
Upgrade
grpc-goto a version that resolves this vulnerability.Fixed in 1.83.1 - Upgrade
Upgrade
grpc-goto a version that resolves this vulnerability.Fixed in master
Event History
Frequently Asked Questions
Which deployments are exposed to the RBAC bypass?
Deployments using the gRPC-Go xDS RBAC HTTP filter before version 1.83.1 are exposed when they have DENY policies whose header matcher names use mixed case, such as X-Role or User-Agent. Incoming metadata keys are lowercase, so those policies do not match and fail open.
What does an attacker need to do to bypass an affected DENY rule?
An attacker only needs to send a request that would otherwise be rejected by a DENY policy relying on a mixed-case header matcher name. Because the incoming metadata key is lowercase and the configured matcher is not normalized, the rule fails to match.
Are there impacts beyond DENY-policy enforcement?
Yes. The same case mismatch can allow :Scheme or Grpc-Status to evade gRFC A41 validation, and it prevents Host from being rewritten to :authority.
What is the remediation?
Upgrade gRPC-Go to version 1.83.1, which fixes the header matcher normalization issue.