CVE-2026-84303: 
New Relic Agent vulnerability analysis and mitigation

CVE-2026-84303 is an authorization bypass vulnerability in gRPC-Go (the Go language implementation of gRPC) caused by improper handling of case sensitivity in the xDS RBAC HTTP filter. The normalizeHeaderMatcher function in internal/xds/httpfilter/rbac/rbac.go fails to lowercase header matcher names before comparison, even though incoming gRPC metadata keys are always lowercase. This causes DENY policies referencing mixed-case header names (e.g., X-Role, User-Agent) to never match, effectively failing open and allowing requests that should be rejected. All versions of google.golang.org/grpc prior to 1.83.1 are affected. The vulnerability was published on September 1, 2026, with a patch released on the same day. It carries a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-178 (Improper Handling of Case Sensitivity) and CWE-863 (Incorrect Authorization). The normalizeHeaderMatcher function in internal/xds/httpfilter/rbac/rbac.go compared header matcher names against lowercase metadata keys without first normalizing the matcher name to lowercase. Because gRPC metadata keys are unconditionally lowercased at the transport layer, a policy rule referencing X-Role would never match the incoming x-role key — the rule fires no match, and a DENY policy silently fails open. The same case mismatch allowed pseudo-headers like :Scheme (spelled as :Scheme instead of :scheme) or Grpc-Status to evade the gRFC A41 validation that is supposed to reject such matchers, and prevented Host from being correctly rewritten to :authority. The fix, applied in PR #9332, adds a strings.ToLower() call at the start of normalizeHeaderMatcher so all subsequent checks and the matching engine operate on a single normalized name — consistent with how Envoy (using LowerCaseString) and grpc-java handle this (GitHub Advisory, Fix PR #9332, Commit db94828).

Successful exploitation allows an unauthenticated remote attacker to bypass xDS RBAC DENY authorization policies in gRPC-Go services that use the xDS control plane. Any DENY rule referencing a header with mixed-case or canonical-case naming (e.g., X-Role, User-Agent, Authorization) will silently fail to match, permitting unauthorized requests to reach protected gRPC endpoints. Additionally, the case mismatch enables evasion of gRFC A41 validation, allowing malformed or forbidden pseudo-headers like Grpc-Status to pass through, and prevents Host from being correctly aliased to :authority, potentially causing further policy mismatches. The confidentiality and integrity of services relying on header-based RBAC access control are at risk, though availability is not directly impacted (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability is automatable (network-accessible, no authentication or user interaction required) but requires the specific precondition that the target gRPC-Go service uses xDS-based RBAC policies with mixed-case header matcher names in DENY rules. The EPSS score is approximately 0.0031 (0.31%), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, GitHub Advisory).

1. Reconnaissance: Identify gRPC services using gRPC-Go versions prior to 1.83.1 that are configured with xDS-based RBAC policies. Services deployed in service mesh environments (e.g., Istio, Envoy-based xDS control planes) are likely candidates.
2. Identify DENY policy headers: Determine which HTTP headers are referenced in RBAC DENY rules by reviewing control plane configuration or observing service behavior. Target headers that operators commonly write in canonical/mixed case (e.g., X-Role, User-Agent, Authorization).
3. Craft a request: Send a standard gRPC request to the target service. Because the DENY rule uses a mixed-case header name (e.g., X-Role) that never matches the lowercase metadata key (x-role), no special payload manipulation is needed — any request will bypass the DENY policy.
4. Bypass authorization: The RBAC filter evaluates the DENY rule, finds no match due to the case mismatch, and allows the request to proceed. The attacker gains access to endpoints or operations that should have been blocked.
5. Evade A41 validation (optional): To bypass gRFC A41 pseudo-header validation, craft an xDS configuration (if attacker has control plane access) specifying a header matcher like Grpc-Status or :Scheme in mixed case, which would pass the case-sensitive validation check and be accepted as a valid (but dangerous) matcher (GitHub Advisory, Fix PR #9332).

The primary remediation is to upgrade google.golang.org/grpc to version 1.83.1 or later, which contains the fix in commits db94828 (master) and ebba6f3 (v1.83.x backport). As a temporary workaround, operators can redefine all RBAC DENY policy header matchers to use exclusively lowercase header names (e.g., change X-Role to x-role, User-Agent to user-agent) to ensure they match the normalized incoming metadata keys; however, upgrading is strongly recommended as the definitive solution. Organizations using SUSE Linux can apply the vendor security update SUSE-SU-2026:4062-1 (GitHub Advisory, grpc-go Release, SUSE Advisory).

The vulnerability was reported by security researcher alimony (Markus Magnuson) and acknowledged by the gRPC-Go maintainers, who merged the fix on August 19, 2026. The issue was also covered in the Microsoft September 2026 Patch Tuesday roundup by BleepingComputer, which noted it among 966 flaws addressed. The openSUSE and SUSE security teams issued advisories and update packages shortly after the public disclosure. Community discussion has been limited, consistent with the moderate severity and absence of active exploitation (GitHub Advisory, BleepingComputer).