Private tokens could appear in logs if context containing gRPC metadata is logged in google.golang.org/grpc

Description

References

• grpc/grpc-go security advisory · ADVISORY
• grpc/grpc-go commit ab29241 · FIX

More vulnerabilities in google.golang.org/grpc

• CVE-2026-84445HIGH 8.7gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/trans…
• CVE-2026-84304HIGH 8.7gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame…
• CVE-2026-84303MEDIUM 6.3gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does no…
• GO-2026-6061Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc
• GHSA-hrxh-6v49-42gfHIGHgRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities