CVE-2026-84303 in gRPC-Go
Summary
by MITRE • 09/01/2026
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified within the Go language implementation of gRPC, specifically prior to version 1.83.1, stems from a critical case-sensitivity mismatch in the internal xDS RBAC HTTP filter logic located at internal/xds/httpfilter/rbac/rbac.go. The core technical flaw lies in the normalizeHeaderMatcher function which fails to convert header matcher names to lowercase before comparison. This is problematic because incoming metadata keys in gRPC are inherently lowercased by the protocol specification and underlying implementation, yet the RBAC policy evaluation logic expects exact case matches for certain headers or fails to account for this normalization step during rule application. Consequently, when a security administrator configures a DENY policy targeting headers with mixed-case names such as X-Role or User-Agent, the matcher fails to identify these incoming lowercased keys against the configured rules. This discrepancy results in a fail-open state where requests that should be explicitly rejected by the RBAC policy are instead allowed through, effectively bypassing access control restrictions intended to protect backend services from unauthorized or malicious traffic patterns.
The operational impact of this vulnerability is significant as it undermines the integrity of service-to-service authentication and authorization mechanisms enforced via xDS configuration. By allowing mixed-case header values to evade detection, attackers can potentially manipulate request metadata to circumvent security policies designed to restrict access based on specific client attributes or roles. Furthermore, this case mismatch extends beyond simple RBAC bypasses; it interferes with the validation of gRFC A41 which governs HTTP/2 connection preface and settings exchange in gRPC environments. Specifically, headers such as :Scheme are not properly validated against expected values due to the normalization failure, potentially allowing malformed or malicious scheme declarations that could lead to request smuggling or routing anomalies. Additionally, the inability to correctly process case-sensitive variations prevents the proper rewriting of the Host header to the :authority pseudo-header, which is essential for correct HTTP/2 framing and server-side host resolution. This can result in misrouted requests or exposure to host-based attacks where an attacker might exploit the lack of authority validation to access resources on unintended virtual hosts within a multi-tenant gRPC infrastructure.
From a threat modeling perspective, this vulnerability aligns with CWE-150 Improper Neutralization of Escape Metacharacters which broadly covers issues related to case sensitivity in security filters and CWE-284 Improper Access Control where the failure to enforce policy leads to unauthorized access. In terms of MITRE ATT&CK mapping, this flaw facilitates techniques associated with Tactic TA0001 Initial Access or TA0005 Defense Evasion, specifically under sub-techniques that involve manipulating headers to bypass security controls such as WAFs or API gateways. The fail-open nature of the bug means that even if other layers of defense are in place, this specific gRPC internal filter becomes a blind spot for attackers targeting applications relying on xDS-driven RBAC policies for fine-grained access control.
To mitigate this vulnerability and restore proper security posture, organizations must upgrade their gRPC-Go dependencies to version 1.83.1 or later where the normalizeHeaderMatcher function has been corrected to properly handle case insensitivity in header matching. Until such an update is deployed, administrators should consider implementing compensating controls at the network perimeter using external API gateways or service mesh sidecars that enforce strict lowercasing of all incoming headers before they reach the gRPC application layer. It is also advisable to review existing xDS RBAC configurations to ensure no critical DENY policies rely on mixed-case header names, as these will remain ineffective until the underlying library is patched. Regular auditing of dependency versions and automated vulnerability scanning for known CVEs in Go modules are recommended practices to prevent exposure to such implementation flaws that compromise access control integrity.