Missing Authentication for Critical Function in Apache bRPC - CVE-2026-78334
Published: October 23, 2026
Vulnerability identifier: #VU157353
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-78334
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass server authentication and inject unauthorized streaming RPC frames.
The vulnerability exists due to missing authentication and improper connection binding in Apache bRPC's streaming RPC parser when frames bypass InputMessenger's authentication hook and streams bind lazily to an incoming frame's socket. A remote attacker can send unauthenticated streaming frames or frames carrying another connection's stream identifier to make the server accept unauthorized stream data.
Affected software
Apache bRPC
How to mitigate CVE-2026-78334
Install security update from vendor's website.
Apache bRPC - update to 1.18.0