CVE-2026-84303

Name of the Vulnerable Software and Affected Versions gRPC-Go versions prior to 1.83.1

Description The xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go fails to lowercase header matcher names within the normalizeHeaderMatcher() function, despite incoming metadata keys being lowercase. This case mismatch allows DENY policies using mixed-case names, such as X-Role or User-Agent, to fail open, permitting requests that should be rejected. Additionally, this behavior allows :Scheme or Grpc-Status to bypass gRFC A41 validation and prevents the Host header from being rewritten to :authority.

Recommendations Update to version 1.83.1.