Skip to content

[Aikido] Fix security issue in google.golang.org/grpc via minor version upgrade from 1.79.3 to 1.82.1 - #112

Merged
chenxin0723 merged 1 commit into
masterfrom
fix/aikido-security-MAINT-1498-update-packages-72216596-axhl
Jul 23, 2026
Merged

[Aikido] Fix security issue in google.golang.org/grpc via minor version upgrade from 1.79.3 to 1.82.1#112
chenxin0723 merged 1 commit into
masterfrom
fix/aikido-security-MAINT-1498-update-packages-72216596-axhl

Conversation

@aikido-autofix

Copy link
Copy Markdown
Contributor

Upgrade grpc-go to fix authorization bypass in xDS RBAC, HTTP/2 Rapid Reset DoS, and server panic vulnerabilities.

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
GHSA-hrxh-6v49-42gf
HIGH
[google.golang.org/grpc] Three vulnerabilities affect xDS RBAC authorization and HTTP/2 transport: authorization bypass when unsupported Metadata/RequestedServerName matchers are silently ignored, denial of service via HTTP/2 Rapid Reset mitigation bypass causing high CPU, and server panic when NOT rules wrap unsupported fields in RBAC policies.
🔗 Related Tasks

@aikido-autofix aikido-autofix Bot added the aikido Label created by Aikido AutoFix label Jul 23, 2026
@theplant-ci

Copy link
Copy Markdown

Hi @aikido-autofix[bot]. Thanks for your PR.

PRs from untrusted users cannot be marked as trusted with /ok-to-test in this repo meaning untrusted PR authors can never trigger tests themselves. Collaborators can still trigger tests on the PR using /test all.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@chenxin0723
chenxin0723 marked this pull request as ready for review July 23, 2026 01:40
@chenxin0723
chenxin0723 merged commit 58400d5 into master Jul 23, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aikido Label created by Aikido AutoFix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants