Live › vulnerability › CVE-2026-86249
Go to dashboardWhen a bRPC server sets both an Authenticator and internal_port, a request for a built-in page on internal_port marks the whole connection as authenticated. Later requests on that connection reach ordinary services without credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only servers that use both ServerOptions.auth and ServerOptions.internal_port with an Authenticator are exposed, because the bypass depends on that combination. Servers that use only one of the two, or that serve ordinary services only on the main port, are not affected by this description.
No product ranges from the sources yet.
ServerOptions.internal_port and ServerOptions.auth set together in the server startup code1.18.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. VerifyHttpRequest() returns true without checking any credential when a built-in service is requested on internal_port, and this verdict is not per - request: verification runs only for the first message of a connection and the result latches the connection. Sending a request such as GET /status to internal_port first authenticates the whole connection, after which every subsequent request dispatched on the same connection is handled without ever calling VerifyHttpRequest(). This lets a remote attacker reach ordinary (non-built-in, non-tabbed) authenticated services without supplying valid credentials whenever the server uses ServerOptions.internal_port together with an Authenticator. The fix restricts internal_port so that it carries only built-in and Tabbed services; requests for ordinary services sent to internal_port are rejected with EPREM / HTTP 403.
Mitigation / Fix: upgrade to 1.18.0 or apply PR https://github.com/apache/brpc/pull/3525 .
Users who rely on serving normal services on internal_port must move those requests to the port passed to Server::Start().
This page as .md · .json · in your agent: get_signal("CVE-2026-86249")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.