CVE-2026-48830

Published: Ott 21, 2026 Last Modified: Ott 21, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection.

When ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener, a builtin request received as the first message on a socket may cause the connection to be treated as authenticated for later requests on that socket. Users are recommended to upgrade to version 1.18.0, which fixes this issue, or apply this PR separately: https://github.com/apache/brpc/pull/3308

287

Improper Authentication

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability Access Control
Potential Impacts:
Read Application Data Gain Privileges Or Assume Identity Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: Not Technology-Specific, Web Based, ICS/OT
Likelihood of Exploit: High
View CWE Details
https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx…
https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb