The vulnerability in the xDS RBAC HTTP filter causes the filter to fail to lowercase header matcher names during normalization while incoming metadata keys remain lowercase. A DENY policy that references a mixed‑case header such as X-Role or User-Agent therefore does not match the actual request headers, allowing traffic that should be rejected to pass through. Similar case mismatches also enable special headers like :Scheme or Grpc-Status to evade gRFC A41 validation and prevent the Host header from being rewritten to :authority. The result is that authorized‑only traffic can be granted access and protocol validation can be subverted.

The affected product is gRPC-Go, the Go language implementation of gRPC, specifically versions prior to 1.83.1. All releases before v1.83.1 are vulnerable.

The CVSS score of 6.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not in the CISA KEV catalog. Attackers can exploit the flaw by sending HTTP requests with mixed‑case header names that the filter fails to match; this bypass is local to the gRPC service and does not require elevated privileges or additional access rights.