{"id":"CVE-2026-48830","kind":"vulnerability","aliases":["CVE-2026-48830"],"related":[],"title":"Apache bRPC: keep-alive connection bypasses authentication on HTTP endpoints","description":"Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection.\n\nWhen ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener, a builtin request received as the first message on a socket may cause the connection to be treated as authenticated for later requests on that socket. Users are recommended to upgrade to version 1.18.0, which fixes this issue, or apply this PR separately:  https://github.com/apache/brpc/pull/3308","summary":"Apache bRPC through 1.17.0 lets an unauthenticated remote client skip authentication on protected non-builtin HTTP endpoints. The bypass works by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection, which marks the socket as authenticated for later requests.","severity":"high","cvss":null,"epss":0.00263,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bliss","brpc","c++","runtime","self-hosted"],"not_affected_if":["builtin-services-private","default-config"],"how_to_check":"- Check the bRPC version in use; affected versions are `1.17.0` and earlier.\n- Look for `ServerOptions.auth` being set while builtin HTTP services are reachable on the public listener.","fix":"- Upgrade Apache bRPC to `1.18.0`.\n- If upgrading is not possible, apply the patch from https://github.com/apache/brpc/pull/3308 separately.","status":"open","published_at":"2026-10-21T12:17:20+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:54+00:00","updated_at":"2026-10-25T05:02:54+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-25T05:02:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache bRPC to `1.18.0`.\n- If upgrading is not possible, apply the patch from https://github.com/apache/brpc/pull/3308 separately.","reach":"internet","title":"Apache bRPC: keep-alive connection bypasses authentication on HTTP endpoints","impact":"medium","summary":"Apache bRPC through 1.17.0 lets an unauthenticated remote client skip authentication on protected non-builtin HTTP endpoints. The bypass works by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection, which marks the socket as authenticated for later requests.","category":"runtime","nicknames":[],"who_cares":["bliss","brpc","c++","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated remote clients reach protected endpoints on the server","analyst_note":"","how_to_check":"- Check the bRPC version in use; affected versions are `1.17.0` and earlier.\n- Look for `ServerOptions.auth` being set while builtin HTTP services are reachable on the public listener.","needs_analyst":false,"not_affected_if":["default-config","builtin-services-private"],"who_is_affected":"Servers that enable ServerOptions.auth and expose builtin HTTP services on a public listener are exposed, since the bypass needs a builtin request as the first message on a socket. Deployments that keep builtin services on a private listener or do not enable authentication can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000627,"input_tokens":3473,"output_tokens":559,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-48830':14A,17A '/apache/brpc/pull/3308':166C '1.17.0':28B,76C '1.18.0':154C 'aliv':5A,59B,105C 'allow':77C 'apach':1A,25B,73C 'appli':160C 'attack':81C 'authent':8A,35B,66B,71C,84C,140C 'bliss':18B 'brpc':2A,19B,26B,74C 'builtin':40B,50B,89C,96C,112C,122C 'bypass':7A,44B,83C 'c':20B 'caus':133C 'client':33B 'connect':6A,60B,106C,135C 'cve':12A,15A 'enabl':110C 'endpoint':11A,42B,91C 'expos':116C 'first':47B,93C,127C 'fix':156C 'github.com':165C 'github.com/apache/brpc/pull/3308':164C 'host':24B 'http':10A,41B,51B,90C,97C,113C 'http/1.1':56B,102C 'improp':70C 'issu':158C 'keep':4A,58B,104C 'keep-al':3A,57B,103C 'later':68B,142C 'let':29B 'listen':120C 'mark':62B 'may':132C 'messag':128C 'non':39B,88C 'non-builtin':38B,87C 'pr':162C 'protect':37B,86C 'public':119C 'receiv':124C 'recommend':149C 'remot':32B,79C 'request':52B,69B,98C,123C,143C 'runtim':21B 'self':23B 'self-host':22B 'send':48B,94C 'separ':163C 'serveroptions.auth':108C 'servic':114C 'skip':34B 'socket':64B,131C,146C 'treat':138C 'unauthent':31B,80C 'upgrad':151C 'user':147C 'version':153C 'work':45B","nicknames":[],"mitigations":[],"who_affected":"Servers that enable ServerOptions.auth and expose builtin HTTP services on a public listener are exposed, since the bypass needs a builtin request as the first message on a socket. Deployments that keep builtin services on a private listener or do not enable authentication can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T12:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-48830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48830","severity":null,"published_at":"2026-10-21T12:17:20+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-48830","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48830","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}