{"id":"CVE-2026-86249","kind":"vulnerability","aliases":["CVE-2026-86249"],"related":[],"title":"Apache bRPC: internal_port lets requests skip authentication on a shared connection","description":"On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. VerifyHttpRequest() returns true without checking any credential when a built-in service is requested on internal_port, and this verdict is not per - request: verification runs only for the first message of a connection and the result latches the connection. Sending a request such as GET /status to internal_port first authenticates the whole connection, after which every subsequent request dispatched on the same connection is handled without ever calling VerifyHttpRequest(). This lets a remote attacker reach ordinary (non-built-in, non-tabbed) authenticated services without supplying valid credentials whenever the server uses ServerOptions.internal_port together with an Authenticator. The fix restricts internal_port so that it carries only built-in and Tabbed services; requests for ordinary services sent to internal_port are rejected with EPREM / HTTP 403. \n\n\n\nMitigation / Fix: upgrade to 1.18.0 or apply PR https://github.com/apache/brpc/pull/3525 . \n\n\n\nUsers who rely on serving normal services on internal_port must move those requests to the port passed to Server::Start().","summary":"When a bRPC server sets both an Authenticator and internal_port, a request for a built-in page on internal_port marks the whole connection as authenticated. Later requests on that connection reach ordinary services without credentials.","severity":"high","cvss":null,"epss":0.00325,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["brpc","c++","package","self-hosted"],"not_affected_if":["default-config","no-internal-port"],"how_to_check":"- Look for `ServerOptions.internal_port` and `ServerOptions.auth` set together in the server startup code\n- Check the bRPC version in the build file or lockfile; unknown if the sources do not give a range","fix":"- Upgrade bRPC to `1.18.0` or later\n- Or apply the fix from PR https://github.com/apache/brpc/pull/3525\n- Move normal service traffic off internal_port onto the port passed to Server::Start()","status":"open","published_at":"2026-10-21T13:20:04+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T05:02:20+00:00","updated_at":"2026-10-25T05:02:20+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T05:02:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade bRPC to `1.18.0` or later\n- Or apply the fix from PR https://github.com/apache/brpc/pull/3525\n- Move normal service traffic off internal_port onto the port passed to Server::Start()","reach":"network","title":"Apache bRPC: internal_port lets requests skip authentication on a shared connection","impact":"high","summary":"When a bRPC server sets both an Authenticator and internal_port, a request for a built-in page on internal_port marks the whole connection as authenticated. Later requests on that connection reach ordinary services without credentials.","category":"package","nicknames":[],"who_cares":["brpc","c++","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker reaches authenticated services without credentials","analyst_note":"Check the NVD entry and the apache/brpc PR 3525 to confirm the affected version range, which the sources here do not state.","how_to_check":"- Look for `ServerOptions.internal_port` and `ServerOptions.auth` set together in the server startup code\n- Check the bRPC version in the build file or lockfile; unknown if the sources do not give a range","needs_analyst":true,"not_affected_if":["default-config","no-internal-port"],"who_is_affected":"Only servers that use both ServerOptions.auth and ServerOptions.internal_port with an Authenticator are exposed, because the bypass depends on that combination. Servers that use only one of the two, or that serve ordinary services only on the main port, are not affected by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":3667,"output_tokens":568,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86249':15A,18A '/apache/brpc/pull/3525':233C '/status':138C '1.18.0':227C '403':222C 'abus':86C 'apach':1A 'appli':229C 'attack':167C 'authent':8A,32B,52B,89C,143C,177C,192C 'brpc':2A,19B,27B,65C 'built':41B,77C,101C,172C,204C 'built-in':40B,76C,100C,203C 'bypass':88C 'c':20B 'call':161C 'carri':201C 'check':95C 'connect':12A,50B,57B,125C,131C,146C,156C 'credenti':62B,97C,182C 'cve':13A,16A 'dispatch':152C 'entir':90C 'eprem':220C 'ever':160C 'everi':149C 'exempt':80C 'first':121C,142C 'fix':194C,224C 'get':137C 'github.com':232C 'github.com/apache/brpc/pull/3525':231C 'handl':158C 'host':24B 'http':75C,221C 'intern':3A,34B,45B,82C,107C,140C,196C,215C,242C 'latch':129C 'later':53B 'let':5A,164C 'mark':47B 'messag':122C 'mitig':223C 'move':245C 'must':244C 'non':171C,175C 'non-built-in':170C 'non-tab':174C 'normal':239C 'ordinari':59B,169C,211C 'packag':21B 'page':43B 'pass':251C 'per':114C 'port':4A,35B,46B,73C,83C,108C,141C,188C,197C,216C,243C,250C 'pr':230C 'reach':58B,168C 'reject':218C 'reli':236C 'remot':166C 'request':6A,37B,54B,105C,115C,134C,151C,209C,247C 'restrict':195C 'result':128C 'return':92C 'run':117C 'self':23B 'self-host':22B 'send':132C 'sent':213C 'serv':238C 'server':28B,66C,185C,253C 'serveroptions.auth':70C 'serveroptions.internal':72C,187C 'servic':60B,79C,103C,178C,208C,212C,240C 'set':29B,68C 'share':11A 'skip':7A 'start':254C 'subsequ':150C 'suppli':180C 'tab':176C,207C 'togeth':189C 'true':93C 'upgrad':225C 'use':186C 'user':234C 'valid':181C 'verdict':111C 'verif':116C 'verifyhttprequest':91C,162C 'whenev':183C 'whole':49B,145C 'without':61B,94C,159C,179C","nicknames":[],"mitigations":[],"who_affected":"Only servers that use both ServerOptions.auth and ServerOptions.internal_port with an Authenticator are exposed, because the bypass depends on that combination. Servers that use only one of the two, or that serve ordinary services only on the main port, are not affected by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T13:20:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86249","severity":null,"published_at":"2026-10-21T13:20:04+00:00","modified_at":"2026-10-22T16:56:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-86249","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-86249","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}