—

GO-2026-6441

Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc

Quick fix

GO-2026-6441 — google.golang.org/grpc: upgrade to the fixed version with the command below.

go get google.golang.org/grpc@v1.83.1

Details

In google.golang.org/grpc, the xDS RBAC HTTP filter does not lowercase header matcher names before evaluating them against incoming request metadata. When an RBAC policy defines rules (such as DENY) referencing headers with uppercase or mixed-case characters, the rule fails to match, causing authorization policies to fail open. Additionally, callers can evade gRFC A41 validation blocking "grpc-" prefixed headers and ":scheme" via variations in casing.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/google.golang.org/grpc

Introduced in: 0Fixed in: 1.83.1

Fixgo get google.golang.org/grpc@v1.83.1

References

https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3[ADVISORY]
https://github.com/grpc/grpc-go/pull/9332[FIX]