Improper Handling of Case Sensitivity in gRPC-go - CVE-2026-84303
Published: August 19, 2026 / Updated: September 2, 2026
Vulnerability identifier: #VU144262
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84303
CWE-ID: CWE-178
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization policies.
The vulnerability exists due to improper handling of case sensitivity in the xDS RBAC HTTP filter implementation when matching request headers against configured RBAC header rules. A remote attacker can send requests using mixed-case or canonical-case headers to bypass authorization policies.
Requests that should be rejected under DENY rules may instead be served because incoming metadata keys are lowercased before evaluation.
Affected software
gRPC-go
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Public Cloud Module
terraform-provider-null
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Public Cloud Module
terraform-provider-null
How to mitigate CVE-2026-84303
Install security update from vendor's website.
gRPC-go - update to 1.83.1
terraform-provider-null - update to 3.0.0-150200.6.27.1
terraform-provider-null - update to 3.0.0-150200.6.27.1