Apache bRPC: Authentication bypass via internal_port and built-in services
Summary
On bRPC servers that set both ServerOptions.auth and ServerOptions.internal_port, built-in HTTP services requested on internal_port are accepted without any credential check. The authentication result latches to the whole connection, so an attacker who first sends such a request can reach ordinary authenticated services on that connection without valid credentials. The attack is remote and needs no authentication, but it only applies when both settings are used together.
Affected
- Apache bRPC versions before 1.18.0
- Only servers that set both ServerOptions.auth and ServerOptions.internal_port
Fixed in
- Apache bRPC 1.18.0 and fix PR 3525
- Open point: a follow-up PR 3622 reports that RTMP traffic was still served on internal_port. Unknown whether this is included in 1.18.0.
Workaround
- Move normal service traffic to the main port passed to Server::Start()
- Restrict network access to internal_port to trusted management hosts
- Remove internal_port if it is not needed
Exploitation
- Not listed in CISA KEV.
- CISA SSVC: automatable yes, technical impact total.
- No public PoC or active exploitation confirmed in the sources reviewed.
- EPSS: 0.33% probability of exploitation in the next 30 days.
Our recommendation
- Upgrade to bRPC 1.18.0 or apply PR 3525, and verify that the RTMP follow-up is included.
- Check whether internal_port is set in your in-house software or vendor products, and ask suppliers which bRPC version they use.
- Until patched, move traffic off internal_port or restrict it to trusted hosts.
- Monitor logs for unauthenticated requests on internal_port.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list thread lists.apache.org
- Apache bRPC fix pull request 3525 github.com
- Follow-up pull request 3622 (RTMP on internal_port) github.com
- OpenCVE CVE-2026-86249 app.opencve.io
- VulDB 424778 vuldb.com
- StriX CVE-2026-86249 www.strix.ai
- SecurityOnline: bRPC vulnerabilities patched in 1.18.0 securityonline.info
- Mail archive dev@brpc.apache.org msg18447 www.mail-archive.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:36.
Original description (NVD)
On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. VerifyHttpRequest() returns true without checking any credential when a built-in service is requested on internal_port, and this verdict is not per - request: verification runs only for the first message of a connection and the result latches the connection. Sending a request such as GET /status to internal_port first authenticates the whole connection, after which every subsequent request dispatched on the same connection is handled without ever calling VerifyHttpRequest(). This lets a remote attacker reach ordinary (non-built-in, non-tabbed) authenticated services without supplying valid credentials whenever the server uses ServerOptions.internal_port together with an Authenticator. The fix restricts internal_port so that it carries only built-in and Tabbed services; requests for ordinary services sent to internal_port are rejected with EPREM / HTTP 403. Mitigation / Fix: upgrade to 1.18.0 or apply PR https://github.com/apache/brpc/pull/3525 . Users who rely on serving normal services on internal_port must move those requests to the port passed to Server::Start().
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.