Access Control Bypass in Apache bRPC HTTP Protocol Implementation

CVE-2026-84747

What is CVE-2026-84747?

The vulnerability in Apache bRPC's HTTP protocol allows remote attackers to bypass access control rules enforced by a front proxy. Specifically, the method dispatch function erroneously handles request paths with empty segments, treating them as their collapsed form and thereby permitting unauthorized access to components that should remain restricted. This misinterpretation of the request path accommodates potential attackers who can exploit the oversight by sending crafted paths to access sensitive resources. To remediate this issue, users are advised to upgrade to version 1.18.0 or apply the provided patch which ensures proper validation of request paths, rejecting any that breach established standards.

References