TLS Endpoint Impersonation in Apache bRPC Versions

CVE-2026-66392

What is CVE-2026-66392?

The vulnerability arises in Apache bRPC, where earlier versions fail to bind the validated server certificate to the expected DNS name or IP address when client TLS peer verification is enabled. This oversight allows a network attacker with the ability to intercept or redirect connections to impersonate a secure endpoint using a valid certificate from a trusted certificate authority (CA) for a different identity. Applications using a bRPC client Channel can be particularly vulnerable if they access untrusted networks while relying on certificate verification against a CA that can misissue certificates. To mitigate this risk, upgrading to Apache bRPC version 1.18.0 is strongly recommended. This version introduces enhanced verification options that secure channel connections, improving the integrity of TLS communications.

References