Improper Handling of Case Sensitivity in grpc-go - #VU144262
Published: August 19, 2026
Vulnerability identifier: #VU144262
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-178
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization policies.
The vulnerability exists due to improper handling of case sensitivity in the xDS RBAC HTTP filter implementation when matching request headers against configured RBAC header rules. A remote attacker can send requests using mixed-case or canonical-case headers to bypass authorization policies.
Requests that should be rejected under DENY rules may instead be served because incoming metadata keys are lowercased before evaluation.
Affected software
grpc-go
Remediation
Install security update from vendor's website.
grpc-go - update to 1.83.1