Apache bRPC: Authentication bypass for HTTP endpoints via keep-alive connection
Summary
Apache bRPC up to and including 1.17.0 can let a remote, unauthenticated attacker bypass authentication for protected non-builtin HTTP endpoints. The bypass works when ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener. A builtin HTTP request sent first on an HTTP/1.1 keep-alive connection can cause later requests on that socket to be treated as authenticated.
Affected
- Apache bRPC 0 to 1.17.0 (lower bound not stated; treat all versions up to and including 1.17.0 as affected)
- Only if ServerOptions.auth is enabled and builtin HTTP services are reachable on the public listener
Fixed in
- Apache bRPC 1.18.0 (unaffected according to the CVE record and the vendor release announcement)
- Alternatively, upstream pull request #3308 applied separately
Workaround
- No vendor-issued workaround beyond the upgrade and the pull request.
- Inferred mitigation: remove public access to builtin HTTP services so they are not reachable from the internet. This is derived from the trigger conditions, not a vendor instruction.
Exploitation
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- VulDB reports no exploit available; its 0-day tag reflects public disclosure, not confirmed exploitation.
- HOL states the CVE is not marked as known exploited.
- No public proof of concept found. CISA KEV catalogue not checked directly.
Our recommendation
- Find out whether bRPC is used in any product or in-house service you operate or rely on.
- Check the bRPC version and upgrade to 1.18.0 or later, or apply pull request #3308.
- Confirm that builtin HTTP service endpoints are not reachable from the internet.
- Monitor for unusual authenticated-looking access to protected endpoints until patched.
- Note: the NVD status is Deferred and the CVSS score of 9.1 could not be confirmed from a primary source.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list thread (CVE-2026-48830) lists.apache.org
- Apache bRPC 1.18.0 release announcement (mail archive) www.mail-archive.com
- Apache bRPC releases on GitHub github.com
- CVE record on OpenCVE app.opencve.io
- Strix CVE-2026-48830 www.strix.ai
- HOL CVE-2026-48830 hol.org
- VulDB 424748 vuldb.com
- Secondary write-up on bRPC exposure and mitigation dev.to
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:38.
Original description (NVD)
Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener, a builtin request received as the first message on a socket may cause the connection to be treated as authenticated for later requests on that socket. Users are recommended to upgrade to version 1.18.0, which fixes this issue, or apply this PR separately: https://github.com/apache/brpc/pull/3308
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.