CVE-2026-84303: 
cAdvisor Schwachstellenanalyse und -minderung

CVE-2026-84303 is an authorization bypass vulnerability in gRPC-Go (the Go language implementation of gRPC) caused by improper handling of case sensitivity in the xDS RBAC HTTP filter. The normalizeHeaderMatcher function in internal/xds/httpfilter/rbac/rbac.go fails to lowercase header matcher names before comparison, even though incoming gRPC metadata keys are always lowercase. This mismatch causes DENY policies using mixed-case header names (e.g., X-Role, User-Agent) to fail open, allowing requests that should be rejected to pass through. All versions of google.golang.org/grpc prior to 1.83.1 are affected. The vulnerability was published on September 1, 2026, with a patch released on the same day. It carries a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-178 (Improper Handling of Case Sensitivity) and CWE-863 (Incorrect Authorization). In internal/xds/httpfilter/rbac/rbac.go, the normalizeHeaderMatcher function processed header matcher names verbatim from xDS configuration without lowercasing them, while the gRPC metadata engine always stores and compares keys in lowercase. As a result, a DENY policy configured with a header name like X-Role would never match the incoming lowercase key x-role, causing the rule to silently fail open and serve the request. The same case mismatch allowed pseudo-headers like :Scheme (spelled as :Scheme instead of :scheme) and grpc- prefixed headers (e.g., Grpc-Status) to evade gRFC A41 validation checks, and prevented Host from being correctly rewritten to :authority. The fix, applied in PR #9332, adds a strings.ToLower() call at the start of normalizeHeaderMatcher so all subsequent checks and the matching engine operate on a normalized name (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to bypass xDS RBAC DENY authorization policies in gRPC-Go services by sending requests with headers whose names are spelled in mixed or canonical case (e.g., X-Role instead of x-role). The bypassed policies fail open, meaning traffic that should have been denied is served normally, resulting in unauthorized access to protected gRPC endpoints. Additionally, the gRFC A41 safety guards against grpc- prefixed headers and :scheme pseudo-headers can be evaded, and Host-based routing rules may not function correctly. The confidentiality and integrity impacts are rated low, with no availability impact, as the attacker can read or manipulate data accessible through the bypassed authorization boundary (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is network-exploitable with no authentication or user interaction required, but requires the precondition that the target service has xDS RBAC DENY policies configured using mixed-case header names. The EPSS score is approximately 0.0031 (0.31%), indicating a low probability of exploitation in the near term. The vulnerability is marked as automatable by NVD SSVC analysis. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify gRPC services using xDS-based RBAC HTTP filters with DENY policies that reference headers in mixed-case or canonical-case format (e.g., X-Role, User-Agent, Authorization). This may be inferred from service mesh configuration leaks or documentation.
2. Identify target headers: Determine which mixed-case header names are used in DENY rules by probing the service or reviewing any accessible xDS control plane configuration.
3. Craft the bypass request: Send a gRPC request that would normally be blocked by the DENY policy. Because the RBAC filter fails to normalize the header matcher name, the incoming lowercase metadata key (e.g., x-role) will never match the mixed-case matcher name (e.g., X-Role), so the DENY rule does not fire.
4. Evade gRFC A41 validation (optional): If the target uses :scheme or grpc- prefixed header matchers for validation, send requests with these headers spelled in non-lowercase form (e.g., Grpc-Status) to bypass the A41 rejection check.
5. Access protected resources: With the DENY policy silently failing open, the attacker's requests are served as if authorized, granting access to protected gRPC endpoints or data (GitHub Advisory, Fix PR).

• Logs: gRPC server access logs showing requests to protected endpoints that should have been denied by RBAC policy, particularly from unexpected clients or with unusual header combinations; absence of PermissionDenied responses where DENY policies are configured.
• Configuration: xDS RBAC policy configurations containing header matcher names with uppercase letters (e.g., X-Role, User-Agent, Authorization) in DENY rules — these are the conditions that trigger the vulnerability and may indicate misconfiguration being exploited.
• Network: Unexpected successful gRPC calls to endpoints protected by header-based DENY policies; traffic patterns inconsistent with expected authorization outcomes.

Upgrade google.golang.org/grpc to version 1.83.1 or later, which contains the fix in commits db9482836c298f234c896cf82ab68cafc78237f8 (master) and ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe (v1.83.x backport). As a temporary workaround, review all xDS RBAC policies and redefine any DENY rules to use only fully lowercase header names (e.g., change X-Role to x-role, User-Agent to user-agent), which ensures the matcher names align with the normalized incoming metadata keys. Upgrading to the patched version is the recommended and definitive solution (GitHub Advisory, Fix Commit).

The vulnerability was reported by security researcher alimony (Markus Magnuson) and disclosed via the GitHub Security Advisory program. The fix was authored by gRPC-Go maintainer easwars and reviewed by arjan-bal, with the patch merged on August 19, 2026. The issue was noted in the Microsoft September 2026 Patch Tuesday coverage by BleepingComputer, which reported on 966 flaws addressed that month. SUSE and openSUSE issued security advisories for downstream packages (Helm, azure-storage-azcopy, google-cloud-sap-agent) that depend on gRPC-Go, reflecting broad ecosystem impact (BleepingComputer, SUSE Advisory).