CVE-2026-86249 Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internalport, the HTTP built-in service exemption on internalport can be abused to bypass authentication entirely. VerifyHttpRequest returns true without checking any credential when a built-in service is requested on...

CVE-2026-86249 Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internalport, the HTTP built-in service exemption on internalport can be abused to bypass authentication entirely. VerifyHttpRequest returns true without checking any credential when a built-in service is requested on...

CVE-2026-86249

Apache bRPC versions prior to 1.18.0 are vulnerable to an authentication bypass when both ServerOptions.auth and ServerOptions.internal_port are configured. The VerifyHttpRequest() function returns true without checking credentials when a built-in service is requested on the internal_port. Becaus...

CVE-2026-86249 Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internalport, the HTTP built-in service exemption on internalport can be abused to bypass authentication entirely. VerifyHttpRequest returns true without checking any credential when a built-in service is requested on...

Apache bRPC authorization issue vulnerability

Versions of Apache bRPC prior to 1.18.0 contain an authorization issue vulnerability. This vulnerability arises when ServerOptions.auth and ServerOptions.internalport are set simultaneously; the HTTP built-in service on internalport can then be exploited. Upon receiving authentication for the fir...