Improper Authorization Vulnerability in Apache bRPC on Multiple Platforms
CVE-2026-84748

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Brpc
Vendor
CVE Published:
21 October 2026

What is CVE-2026-84748?

A security vulnerability in Apache bRPC allows remote attackers to access built-in services via the public port due to improper authorization. On systems running bRPC versions earlier than 1.18.0, certain protocol dispatch paths do not enforce the required security measures, leading to the potential exposure of sensitive runtime information. To mitigate this risk, it is advised to upgrade to version 1.18.0 or apply the provided security patch.

Affected Version(s)

Apache bRPC 0 < 1.18.0

References

https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude
.