Authentication Bypass in Apache bRPC Affects Streaming Functionality

CVE-2026-78334

What is CVE-2026-78334?

The vulnerability in Apache bRPC allows a remote attacker to bypass server authentication on the streaming RPC path, enabling the injection or delivery of streaming frames. This occurs in versions earlier than 1.18.0, where the absence of proper authentication checks in the streaming parser permits unauthenticated peers to exchange frames. In scenarios where a bRPC server is configured with authentication and is exposed to an untrusted network, unauthorized access can result as frames can be accepted based on the stream ID, regardless of the originating socket. To mitigate this risk, it is crucial to upgrade bRPC to version 1.18.0 or apply the available patch that ensures strict checks on incoming streaming frames during the authentication process.

References