Unscored severity · published Oct 21, 2026
CVE-2026-48830
Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
–
CVSS
0.3%
EPSS
No
On KEV
Description
Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection.
When ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener, a builtin request received as the first message on a socket may cause the connection to be treated as authenticated for later requests on that socket. Users are recommended to upgrade to version 1.18.0, which fixes this issue, or apply this PR separately: https://github.com/apache/brpc/pull/3308
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Apache bRPC · Apache Software Foundation
through 1.17.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48830
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48830
lists.apache.org
https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb
More from Apache bRPC
9.8
CVE-2025-60021
Apache bRPC: Remote command injection vulnerability in heap builtin service
7.5
CVE-2026-82230
Apache bRPC: Stack Exhaustion via Unbounded Recursion in mcpack2pb Parser
7.5
CVE-2026-74757
Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count
7.5
CVE-2026-56386
Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
6.5
CVE-2026-90484
Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash