CVE-2026-48830— Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
Quick assessment
Affected
Apache Software Foundation Apache bRPC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache bRPC（1.17.0 及更早版本）中存在身份验证不当漏洞。远程未认证攻击者可利用该漏洞，通过在同一 HTTP/1.1 长连接（keep-alive）上首先发送一个内置 HTTP 请求，从而绕过受保护的非内置 HTTP 端点的身份验证机制。 当启用了 且内置 HTTP 服务暴露在公共监听器上时，若某个套接字接收到的第一条消息是内置请求，该连接可能会被错误地视为已认证，导致后续在该连接上的请求无需再次进行身份验证。建议用户升级至 1.18.0 版本以修复此问题，或单独应用此修复补丁：https://gi
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-48830
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
Source: CVE Program / CVE List V5
Vulnerability Description
Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection.
When ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener, a builtin request received as the first message on a socket may cause the connection to be treated as authenticated for later requests on that socket. Users are recommended to upgrade to version 1.18.0, which fixes this issue, or apply this PR separately: https://github.com/apache/brpc/pull/3308
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache bRPC | 0 ~ 1.17.0 | - |
|
II. Public POCs for CVE-2026-48830
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48830
请登录查看更多情报信息。
Other References for CVE-2026-48830 (1)
-
https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb vendor-advisory
Same Patch Batch · Apache Software Foundation · 2026-10-21 · 39 CVEs total
| CVE-2026-56387 | Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser | |
| CVE-2026-78048 | Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Deco | |
| CVE-2026-74758 | Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling | |
| CVE-2026-74757 | Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count | |
| CVE-2026-74755 | Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service | |
| CVE-2026-66392 | Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names | |
| CVE-2026-61916 | Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms | |
| CVE-2026-61902 | Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits | |
| CVE-2026-58064 | Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation | |
| CVE-2026-56388 | Apache bRPC: Out-of-Bounds Write in Redis Command Parser | |
| CVE-2026-78058 | Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path | |
| CVE-2026-56386 | Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser | |
| CVE-2026-54427 | Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser | |
| CVE-2026-54426 | Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser | |
| CVE-2026-54425 | Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding | |
| CVE-2026-59229 | Apache IoTDB: Legacy Pipe Privilege Escalation | |
| CVE-2026-59562 | Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe send | |
| CVE-2026-41114 | Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JD | |
| CVE-2026-58663 | Apache IoTDB: Auth Bypass in pipeTransfer() interface | |
| CVE-2026-82425 | Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service |
Showing top 20 of 39 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache bRPC
-
CVE-2026-90484
Apache bRPC: Null pointer dereference in MySQL reply parser -
CVE-2026-87849
Apache bRPC: Out-of-bounds read via non-object fields in Dis -
CVE-2026-86249
Apache bRPC: Authentication bypass when a server sets Server -
CVE-2026-86147
Apache bRPC: Arbitrary file creation/truncation via /flags a -
CVE-2026-86146
Apache bRPC: HTTP Request Smuggling and Header Injection via
Same vendor: Apache Software Foundation
-
CVE-2026-90484
Apache bRPC: Null pointer dereference in MySQL reply parser -
CVE-2026-87849
Apache bRPC: Out-of-bounds read via non-object fields in Dis -
CVE-2026-86249
Apache bRPC: Authentication bypass when a server sets Server -
CVE-2026-86147
Apache bRPC: Arbitrary file creation/truncation via /flags a -
CVE-2026-86146
Apache bRPC: HTTP Request Smuggling and Header Injection via
Same weakness: CWE-287
-
CVE-2026-86249
Apache bRPC: Authentication bypass when a server sets Server -
CVE-2026-93744
IBM i Improper Authentication -
CVE-2026-113682
Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass -
CVE-2026-105949
Cruise-control: streams for apache kafka cruise control: aut -
CVE-2026-113469
Improper Signature Verification of Active Update Files
V. Comments for CVE-2026-48830
No comments yet