CVE-2026-86249

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: Apache Software Foundation

Description

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. VerifyHttpRequest() returns true without checking any credential when a built-in service is requested on internal_port, and this verdict is not per - request: verification runs only for the first message of a connection and the result latches the connection. Sending a request such as GET /status to internal_port first authenticates the whole connection, after which every subsequent request dispatched on the same connection is handled without ever calling VerifyHttpRequest(). This lets a remote attacker reach ordinary (non-built-in, non-tabbed) authenticated services without supplying valid credentials whenever the server uses ServerOptions.internal_port together with an Authenticator. The fix restricts internal_port so that it carries only built-in and Tabbed services; requests for ordinary services sent to internal_port are rejected with EPREM / HTTP 403. Mitigation / Fix: upgrade to 1.18.0 or apply PR https://github.com/apache/brpc/pull/3525 . Users who rely on serving normal services on internal_port must move those requests to the port passed to Server::Start().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-09

NVD

CVE-2026-86249

EUVD

EUVD-2026-107228

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache bRPC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability affects Apache bRPC servers configured with both authentication enabled and an internal port. It allows attackers to bypass authentication by sending a request to a built-in service on the internal port first, which then grants access to all subsequent requests on the same connection without requiring credentials.

Detection Guidance

I don't know

Check if your bRPC server uses ServerOptions.auth and ServerOptions.internal_port together. Inspect server configuration for internal_port settings and verify if built-in services are exposed on it.

Impact Analysis

If you run a bRPC server with ServerOptions.auth and ServerOptions.internal_port enabled, an attacker could exploit this to access authenticated services without valid credentials. This could lead to unauthorized data access, manipulation, or service disruption.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and authentication, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized access risks data breaches and non-compliance penalties.

Mitigation Strategies

Upgrade to bRPC version 1.18.0 or apply PR https://github.com/apache/brpc/pull/3525. If using internal_port for normal services, move those services to the port specified in Server::Start().

Hi! I’m here to help you understand CVE-2026-86249. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...