Live › vulnerability › CVE-2026-48830
Go to dashboardApache bRPC through 1.17.0 lets an unauthenticated remote client skip authentication on protected non-builtin HTTP endpoints. The bypass works by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection, which marks the socket as authenticated for later requests.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Servers that enable ServerOptions.auth and expose builtin HTTP services on a public listener are exposed, since the bypass needs a builtin request as the first message on a socket. Deployments that keep builtin services on a private listener or do not enable authentication can skip this.
No product ranges from the sources yet.
1.17.0 and earlier.ServerOptions.auth being set while builtin HTTP services are reachable on the public listener.1.18.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection.
When ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener, a builtin request received as the first message on a socket may cause the connection to be treated as authenticated for later requests on that socket. Users are recommended to upgrade to version 1.18.0, which fixes this issue, or apply this PR separately: https://github.com/apache/brpc/pull/3308
This page as .md · .json · in your agent: get_signal("CVE-2026-48830")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.