CVE-2026-84303: gRPC-Go RBAC Auth Bypass Vulnerability

CVE-2026-84303 Overview

CVE-2026-84303 affects gRPC-Go, the Go language implementation of gRPC. The vulnerability resides in the xDS Role-Based Access Control (RBAC) HTTP filter located at internal/xds/httpfilter/rbac/rbac.go. The normalizeHeaderMatcher function fails to lowercase header matcher names, while incoming metadata keys are always lowercase. A DENY policy referencing headers with mixed-case names such as X-Role or User-Agent never matches and fails open. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. The issue is fixed in version 1.83.1.

Critical Impact
DENY policies configured with mixed-case header names silently fail open, permitting requests that RBAC should reject.

Affected Products

gRPC-Go versions prior to 1.83.1
Services using the xDS RBAC HTTP filter for authorization
Systems relying on gRFC A41 header validation in gRPC-Go

Discovery Timeline

2026-09-01 - CVE-2026-84303 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84303

Vulnerability Analysis

The vulnerability is an Improper Handling of Case Sensitivity issue [CWE-178] in the xDS RBAC HTTP filter. Incoming gRPC metadata keys are normalized to lowercase before matching, but the RBAC filter's normalizeHeaderMatcher function compares configured matcher names as-is. Any DENY rule authored with a mixed-case header name silently fails to match, allowing requests that operators intended to reject. The same defect undermines gRFC A41 header validation. Reserved names such as :Scheme and Grpc-Status escape the forbidden-name check because the code only compares against lowercase literals. Additionally, a matcher for Host is not rewritten to :authority, breaking the intended equivalence documented in the gRFC.

Root Cause

The root cause is a missing case-normalization step. normalizeHeaderMatcher used direct string equality against lowercase constants (":scheme", "host", "grpc-") without first lowercasing header.GetName(). Envoy and grpc-java lowercase matcher names, so gRPC-Go's behavior diverged from the reference implementations.

Attack Vector

An attacker sends gRPC requests over the network with no authentication required. If the target service's xDS configuration contains DENY policies referencing headers with any uppercase character, the matcher never fires and the request bypasses the policy. Exploitation depends on the specific RBAC configuration deployed via xDS.

// Security patch in internal/xds/httpfilter/rbac/rbac.go
// xds/rbac: lowercase header matcher names before matching (#9332)

// normalizeHeaderMatcher lowercases the name of a header matcher, rejects the
// names that A41 forbids (:scheme or a grpc- prefixed name) and rewrites a
// "host" matcher to ":authority".
func normalizeHeaderMatcher(header *v3routepb.HeaderMatcher) error {
    // The keys of the metadata the matchers run against are always lowercase,
    // so a name that contains an uppercase character matches no header at all
    // and the rule using it never fires. Lowercase the name, as Envoy and
    // grpc-java do, both to make it match and to keep the checks below from
    // being evaded by the case of the name.
    name := header.GetName()
    lowerName := strings.ToLower(name)
    if lowerName != name {
        header.Name = lowerName
    }
    if lowerName == ":scheme" {
        return fmt.Errorf("rbac: header matcher for %q is %q", name, ":scheme")
    }
    if strings.HasPrefix(lowerName, "grpc-") {
        return fmt.Errorf("rbac: header matcher for %q starts with %q", name, "grpc-")
    }
    if lowerName == "host" {
        header.Name = ":authority"
    }
    // ...
}

Source: GitHub Commit db9482836

Detection Methods for CVE-2026-84303

Indicators of Compromise

Requests reaching backend services that carry header values a DENY rule was intended to block.
xDS RBAC configurations containing header matcher names with any uppercase character (for example, X-Role, User-Agent, Authorization).
Absence of expected RBAC denial log entries in services with mixed-case matcher configurations.

Detection Strategies

Audit deployed xDS route configurations for HeaderMatcher entries where name is not fully lowercase.
Correlate application access logs with RBAC decision logs to identify requests that should have been denied but reached the backend.
Inventory Go module dependencies and flag services running google.golang.org/grpc versions earlier than v1.83.1.

Monitoring Recommendations

Emit and centrally collect RBAC engine decisions and alert on drops in DENY volume after configuration changes.
Track gRPC-Go build versions across service fleets and alert when vulnerable versions are deployed.
Add configuration linting to CI pipelines that rejects xDS RBAC policies containing non-lowercase header matcher names.

How to Mitigate CVE-2026-84303

Immediate Actions Required

Upgrade google.golang.org/grpc to version v1.83.1 or later across all Go services.
Rebuild and redeploy every binary that imports gRPC-Go; module upgrades alone do not update running services.
Review all xDS RBAC policies and rewrite header matcher names to lowercase to align with Envoy and grpc-java behavior.

Patch Information

The fix is included in gRPC-Go release v1.83.1 and tracked in GitHub Security Advisory GHSA-qc2q-p7wx-3px3. The code changes land in Pull Request #9332 and Pull Request #9335, with the primary commit at db9482836 and follow-up ebba6f3f.

Workarounds

Normalize all xDS RBAC header matcher names to lowercase in the control plane before publishing to gRPC-Go clients.
Enforce authorization at an upstream proxy such as Envoy, which already lowercases header matcher names.
Add pre-deployment validation that rejects RBAC policies where any HeaderMatcher.name contains uppercase characters.

bash

# Update gRPC-Go to the patched release
go get google.golang.org/grpc@v1.83.1
go mod tidy
go build ./...

# Verify the resolved version
go list -m google.golang.org/grpc