Authentication Bypass in Apache brpc Server Configuration

CVE-2026-86249

What is CVE-2026-86249?

A vulnerability exists within the Apache brpc server configuration where the combination of ServerOptions.auth and ServerOptions.internal_port can lead to an authentication bypass. When the built-in service is accessed on the internal port, the function VerifyHttpRequest() incorrectly signals that authentication has occurred, without proper credential verification. This results in a scenario where a malicious actor can send a request to the internal port, such as GET /status, which authenticates the entire connection. Subsequent requests on the same connection are erroneously permitted without the need for valid credentials. To mitigate this issue, the internal port should only support built-in and tabbed services; regular service requests to the internal port will be denied with a 403 error. Users are advised to upgrade to version 1.18.0 or apply the changes found in PR-3525.

References