GO-2026-6441
Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-84303
- Alias
- GHSA-qc2q-p7wx-3px3
Description
In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · google.golang.org/grpc | introduced 0, fixed 1.83.1 |
Références
- https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3 ADVISORY
- https://github.com/grpc/grpc-go/pull/9332 FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |