GHSA-qc2q-p7wx-3px3

Suggest an improvement
Source
https://github.com/advisories/GHSA-qc2q-p7wx-3px3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qc2q-p7wx-3px3/GHSA-qc2q-p7wx-3px3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qc2q-p7wx-3px3
Aliases
Downstream
Published
2026-09-08T20:50:21Z
Modified
2026-09-15T19:10:32Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
Details

Summary

A vulnerability in the xDS RBAC HTTP filter implementation in grpc-go allows remote attackers to bypass authorization policies (specifically DENY rules) by using mixed-case or canonical-case header matchers (e.g., X-Role instead of x-role). Additionally, the safety guards introduced by gRFC A41 to block grpc- prefixed headers can be evaded via variations in casing (e.g., Grpc-Status).

Impact

When an operator defines an RBAC policy referencing headers containing uppercase letters (e.g. X-Role), grpc-go fails to match incoming metadata keys because they are unconditionally lowercased. Because of this case-sensitivity mismatch, a policy designed to block requests containing specific header values fails open: the rule is evaluated as a non-match, and traffic that should have been rejected is served.

Furthermore, gRFC A41 requires rejecting configuration schemas specifying header matchers starting with grpc-. Because this check is executed case-sensitively in grpc-go, attackers can bypass the validation by specifying titles like Grpc-Status.

Patches

The problem is fixed in master and in the 1.83.1 release.

Database specific 
{
    "cwe_ids": [
        "CWE-178",
        "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T20:50:21Z",
    "nvd_published_at": "2026-09-01T19:17:30Z",
    "severity": "MODERATE"
}
References

Affected packages

Go / google.golang.org/grpc

Package

Name
google.golang.org/grpc
View open source insights on deps.dev
Purl
pkg:golang/google.golang.org/grpc

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.83.1

Database specific

last_known_affected_version_range 
"<= 1.83.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qc2q-p7wx-3px3/GHSA-qc2q-p7wx-3px3.json"