CVE-2026-48830: CWE-287 Improper Authentication in Apache Software Foundation Apache bRPC
Description
Apache bRPC versions up to 1.17.0 contain an improper authentication vulnerability that allows remote unauthenticated attackers to bypass authentication on protected non-builtin HTTP endpoints. This occurs when ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener. An attacker can send a builtin HTTP request first on an HTTP/1.1 keep-alive connection, causing the connection to be treated as authenticated for subsequent requests. The issue is fixed in Apache bRPC version 1.18.0.
Affected software
Apache Software Foundation
Apache bRPC
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-48830 is an improper authentication vulnerability (CWE-287) in Apache bRPC through version 1.17.0. When ServerOptions.auth is enabled and builtin HTTP services are exposed publicly, a builtin HTTP request sent as the first message on an HTTP/1.1 keep-alive connection causes the server to treat the connection as authenticated for later requests on the same socket. This allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints. The vulnerability is addressed in version 1.18.0 or by applying the referenced pull request.
Potential Impact
Remote unauthenticated attackers can bypass authentication controls on protected HTTP endpoints, potentially gaining unauthorized access to services that require authentication. This could lead to unauthorized actions or data exposure depending on the protected endpoints' functionality.
Mitigation Recommendations
Users should upgrade Apache bRPC to version 1.18.0, which contains the official fix for this vulnerability. Alternatively, they can apply the fix from the referenced pull request (https://github.com/apache/brpc/pull/3308). No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-05-24T07:41:04.457Z
- State
- PUBLISHED
Threat ID: 6ad8a6b62cdf04f656e813e0
Added to database: 10/21/2026, 11:49:10 UTC
Last enriched: 10/21/2026, 12:04:01 UTC
Last updated: 10/21/2026, 12:04:02 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.