CVE-2026-66392

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and who possesses a certificate issued by a CA trusted by the client for another name may impersonate the requested TLS endpoint. Affected Scenarios: Applications use a bRPC client Channel to connect to an untrusted network with certificate verification enabled and trust a CA that can issue certificates for identities other than the intended endpoint. How to Fix: Upgrade to Apache bRPC 1.18.0 and enable VERIFY_PEER with a positive verify_depth. HTTPS Channels automatically verify the certificate against the host in the Channel URL. Callers may set VerifyOptions::expected_peer_name explicitly when the certificate identity differs from the URL host. Alternatively, apply the patch from https://github.com/apache/brpc/pull/3408 . Note: The new option performs DNS SAN or IP SAN verification during the TLS handshake. Configurations that set expected_peer_name while peer verification is disabled are rejected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-66392

EUVD

EUVD-2026-107178

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-297	The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

Executive Summary

Apache bRPC before 1.18.0 validates server certificates during TLS connections but fails to check if the certificate matches the intended DNS name or IP address. This allows attackers with a trusted but unrelated certificate to impersonate the server if they can intercept or redirect traffic.

Detection Guidance

Detecting this vulnerability requires checking if Apache bRPC versions before 1.18.0 are running with client TLS peer verification enabled but without certificate binding to DNS name or IP address. Inspect bRPC client configurations for Channel settings and TLS verification flags. No specific commands are provided in the context.

Impact Analysis

If you use a vulnerable bRPC client to connect to servers over an untrusted network with certificate verification enabled, an attacker could intercept your connection and impersonate the server. This may lead to data leaks or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could violate compliance requirements that mandate secure communication and certificate validation, such as GDPR's data protection principles or HIPAA's transmission security rules. Failure to properly validate certificates may result in non-compliance.

Mitigation Strategies

Upgrade Apache bRPC to version 1.18.0 or later.
Enable VERIFY_PEER with a positive verify_depth in TLS configurations.
Ensure HTTPS Channels verify certificates against the host in the Channel URL.
Set VerifyOptions::expected_peer_name explicitly if the certificate identity differs from the URL host.

Hi! I’m here to help you understand CVE-2026-66392. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...