Improper Authentication Vulnerability in Apache bRPC Affects Multiple Versions

CVE-2026-48830

What is CVE-2026-48830?

The vulnerability in Apache bRPC, present in version 1.17.0, allows an unauthenticated remote attacker to bypass the authentication mechanism for protected non-builtin HTTP endpoints. This occurs when the ServerOptions.auth is enabled and certain builtin HTTP services are publicly exposed. If an initial request to the server is a builtin HTTP request, subsequent requests on the same HTTP/1.1 keep-alive connection may be mistakenly treated as authenticated, granting unauthorized access to sensitive resources. Users are advised to upgrade to version 1.18.0 or apply the relevant fix provided in the GitHub pull request to mitigate this issue.

References