AIKIDO-2026-269867

TL;DR

The RBAC exact path (method name) matcher in @grpc/grpc-js-xds applies a case-insensitive prefix match instead of an exact match. When one gRPC method name is a prefix of another method name that has a different access rule and case-insensitive matching is enabled, requests to the longer method name incorrectly match the shorter method's rule. This lets an access rule meant for one method apply to a different method, producing improper authentication decisions. The fix compares the fully lowercased value for equality instead of using startsWith.