CVE-2026-48830

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener, a builtin request received as the first message on a socket may cause the connection to be treated as authenticated for later requests on that socket. Users are recommended to upgrade to version 1.18.0, which fixes this issue, or apply this PR separately: https://github.com/apache/brpc/pull/3308

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

Configurations

No configuration.

History

30 Oct 2026, 14:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.1

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Autenticación incorrecta en Apache bRPC hasta la versión 1.17.0 incluida permite a un atacante remoto no autenticado eludir la autenticación para endpoints HTTP protegidos que no son integrados, enviando primero una solicitud HTTP integrada en la misma conexión HTTP/1.1 keep-alive.\n\nCuando ServerOptions.auth está habilitado y los servicios HTTP integrados están expuestos en el listener público, una solicitud integrada recibida como el primer mensaje en un socket puede hacer que la conexión se trate como autenticada para solicitudes posteriores en ese socket. Se recomienda a los usuarios actualizar a la versión 1.18.0, que corrige este problema, o aplicar este PR por separado: https://github.com/apache/brpc/pull/3308

21 Oct 2026, 12:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-21 12:17

Updated : 2026-10-30 14:17

NVD link : CVE-2026-48830

Mitre link : CVE-2026-48830

CVE.ORG link : CVE-2026-48830

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-48830", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48830", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T13:35:58.910189Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache bRPC", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.17.0"}, {"status": "unaffected", "version": "1.18.0", "versionType": "semver"}], "platforms": ["all"], "packageURL": "pkg:github/apache/brpc", "packageName": "apache/brpc", "collectionURL": "https://github.com", "defaultStatus": "unaffected"}]}], "published": "2026-10-21T12:17:20.910", "references": [{"url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb", "source": "security@apache.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection.\n\nWhen ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener, a builtin request received as the first message on a socket may cause the connection to be treated as authenticated for later requests on that socket. Users are recommended to upgrade to version 1.18.0, which fixes this issue, or apply this PR separately: https://github.com/apache/brpc/pull/3308"}, {"lang": "es", "value": "Autenticaci\u00f3n incorrecta en Apache bRPC hasta la versi\u00f3n 1.17.0 incluida permite a un atacante remoto no autenticado eludir la autenticaci\u00f3n para endpoints HTTP protegidos que no son integrados, enviando primero una solicitud HTTP integrada en la misma conexi\u00f3n HTTP/1.1 keep-alive.\\n\\nCuando ServerOptions.auth est\u00e1 habilitado y los servicios HTTP integrados est\u00e1n expuestos en el listener p\u00fablico, una solicitud integrada recibida como el primer mensaje en un socket puede hacer que la conexi\u00f3n se trate como autenticada para solicitudes posteriores en ese socket. Se recomienda a los usuarios actualizar a la versi\u00f3n 1.18.0, que corrige este problema, o aplicar este PR por separado: https://github.com/apache/brpc/pull/3308"}], "lastModified": "2026-10-30T14:17:05.647", "sourceIdentifier": "security@apache.org"}