AIKIDO-2026-473995

TL;DR

gRPC's default HTTP proxy mapper decides whether to route a destination through a configured proxy by checking the destination hostname against the no_proxy/NO_PROXY environment variable with a simple substring/suffix comparison instead of a boundary-aware host match. A destination hostname that only shares a suffix with a no_proxy entry can match unintentionally, letting a connection meant to go through the proxy bypass it. Bypassing the proxy skips whatever network boundary the operator configured it to enforce, so the connection reaches its destination directly instead of through the intended intermediary. The fix replaces the substring check with boundary-aware hostname comparison so only exact host or full domain-suffix matches are honored.