GO-2026-6441

In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6441"
}

References

Affected packages

Go / google.golang.org/grpc

Package

Name: google.golang.org/grpc; View open source insights on deps.dev
Purl: pkg:golang/google.golang.org/grpc

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.83.1

Ecosystem specific

{
    "imports": [
        {
            "path": "google.golang.org/grpc/internal/xds/httpfilter/rbac",
            "symbols": [
                "builder.ParseFilterConfig",
                "builder.ParseFilterConfigOverride",
                "parseConfig"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6441.json"