Executive brief
gRPC-Go is a widely-used remote procedure call framework that includes authorization policy enforcement through the xDS RBAC HTTP filter. The vulnerability allows attackers to bypass security policies by using mixed-case header names that fail to match case-sensitive policy definitions, causing restrictive rules to fail open and allow prohibited traffic. Additionally, safety guards against reserved gRPC headers can be evaded through case variations.
Technical details
The vulnerability stems from improper case-sensitivity handling in two areas of the xDS RBAC HTTP filter: (1) policy matching logic that unconditionally lowercases incoming metadata keys but fails to normalize policy-defined header matchers, leading to non-matches when policies reference headers like "X-Role" but requests arrive with "x-role"; and (2) validation logic that case-sensitively checks for gRPC-reserved header prefixes (gRFC A41), allowing attackers to bypass restrictions using variants like "Grpc-Status". The attack requires network access and no authentication; an attacker can exploit this by crafting requests with mixed-case headers that evade security policies. The impact is limited to authorization bypass (no direct data exposure or availability impact). The fix is available in grpc-go version 1.83.1 and later.
Affected products
- Google gRPC-Go <= 1.83.0
Timeline
- 2026-08-19: disclosed
- 2026-09-01: patched: Fixed in version 1.83.1
- 2026-09-08: advisory: GitHub advisory GHSA-qc2q-p7wx-3px3 published