Homepage

Improper Handling of Case Sensitivity Affecting calico-3.30-calicoctl package, versions <3.30.7-r6

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.31% (24th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-CALICO330CALICOCTL-19664393
  • published10 Sept 2026
  • disclosed1 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 1 Sep 2026

NewCVE-2026-84303  (opens in a new tab)
CWE-178  (opens in a new tab)
CWE-863  (opens in a new tab)

How to fix?

Upgrade Minimos:latest calico-3.30-calicoctl to version 3.30.7-r6 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream calico-3.30-calicoctl package and not the calico-3.30-calicoctl package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.