Improper Authentication in Apache bRPC - CVE-2026-86249
Published: October 23, 2026
Vulnerability identifier: #VU157368
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-86249
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication and access ordinary protected services through the internal port.
The vulnerability exists due to improper authentication in Apache bRPC's VerifyHttpRequest() handling when both ServerOptions.auth and ServerOptions.internal_port are configured and a builtin-service exemption authenticates an entire connection. A remote attacker can first send GET /status to the internal port and then send requests for ordinary services over the same connection to access them without valid credentials.
Affected software
Apache bRPC
How to mitigate CVE-2026-86249
Install security update from vendor's website.
Apache bRPC - update to 1.18.0