Incorrect Authorization Affecting google.golang.org/grpc/internal/xds/rbac package, versions <1.82.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GOOGLEGOLANGORGGRPCINTERNALXDSRBAC-18172577
- published22 Jul 2026
- disclosed21 Jul 2026
- creditUnknown
Introduced: 21 Jul 2026
New CVE NOT AVAILABLE CWE-248 Â (opens in a new tab)How to fix?
Upgrade google.golang.org/grpc/internal/xds/rbac to version 1.82.1 or higher.
Overview
Affected versions of this package are vulnerable to Incorrect Authorization in the processing of xDS RBAC policies and HTTP/2 transport handling. An attacker can gain unauthorized access to protected services or cause denial of service by exploiting improper handling of unsupported fields in policy matchers, bypassing rapid reset mitigations, or triggering server panics through crafted policy updates.
Note: This advisory refers to several vulnerabilities as aggregated by the maintainer. For an exact breakdown and affected code, see the Maintainer's referenced advisory and commit.
Workaround
This vulnerability can be mitigated by ensuring xDS management servers do not push RBAC policies with unsupported fields or NOT rules wrapping unhandled fields, and by configuring upstream reverse proxies or load balancers with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency per connection.