Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-86249— Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth

Quick assessment

Affected
Apache Software Foundation Apache bRPC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当 同时配置了 和 时，攻击者可利用 上内置 HTTP 服务的免认证特性，完全绕过身份验证。具体而言， 在 上请求内置服务时会直接返回 ，且不会检查任何凭证；此外，该验证结果并非按请求粒度生效，而是仅对连接的第一个消息执行，并将验证结果“锁定”（latch）至整个连接。因此，若攻击者首先向 发送如 之类的请求，整个连接即被视为已认证，此后该连接上所有后续请求均不再调用 。这使得远程攻击者能够在服务器同时启用 和身份验证器（Authenticator）的情况下，无需提供有效凭证即可访问普通的（非内置、非 Tabbed

AI Predicted 8.1 Difficulty: Easy
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86249

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
Source: CVE Program / CVE List V5
Vulnerability Description
On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. VerifyHttpRequest() returns true without checking any credential when a built-in service is requested on internal_port, and this verdict is not per - request: verification runs only for the first message of a connection and the result latches the connection. Sending a request such as GET /status to internal_port first authenticates the whole connection, after which every subsequent request dispatched on the same connection is handled without ever calling VerifyHttpRequest(). This lets a remote attacker reach ordinary (non-built-in, non-tabbed) authenticated services without supplying valid credentials whenever the server uses ServerOptions.internal_port together with an Authenticator. The fix restricts internal_port so that it carries only built-in and Tabbed services; requests for ordinary services sent to internal_port are rejected with EPREM / HTTP 403.  Mitigation / Fix: upgrade to 1.18.0 or apply PR https://github.com/apache/brpc/pull/3525 .  Users who rely on serving normal services on internal_port must move those requests to the port passed to Server::Start().
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache bRPC 0 ~ 1.18.0 -

II. Public POCs for CVE-2026-86249

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86249

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-86249 (1)

Same Patch Batch · Apache Software Foundation · 2026-10-21 · 39 CVEs total

CVE-2026-56386 Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
CVE-2026-74758 Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
CVE-2026-74757 Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count
CVE-2026-74755 Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service
CVE-2026-66392 Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names
CVE-2026-61916 Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
CVE-2026-61902 Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
CVE-2026-58064 Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
CVE-2026-56388 Apache bRPC: Out-of-Bounds Write in Redis Command Parser
CVE-2026-56387 Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
CVE-2026-78048 Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Deco
CVE-2026-54427 Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
CVE-2026-54426 Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
CVE-2026-54425 Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
CVE-2026-48830 Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for
CVE-2026-59229 Apache IoTDB: Legacy Pipe Privilege Escalation
CVE-2026-59562 Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe send
CVE-2026-41114 Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JD
CVE-2026-58663 Apache IoTDB: Auth Bypass in pipeTransfer() interface
CVE-2026-82231 Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift clien

Showing top 20 of 39 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache bRPC
Same vendor: Apache Software Foundation
Same weakness: CWE-287

V. Comments for CVE-2026-86249

No comments yet

Leave a comment