CVE-2026-78334: CWE-306 Missing Authentication for Critical Function in Apache Software Foundation Apache bRPC

CVE-2026-78334 is a missing authentication vulnerability (CWE-306) in Apache bRPC versions before 1.18.0. When authentication is configured, streaming RPC frames are processed directly by the streaming parser without passing through the authentication hook, allowing unauthenticated peers to send frames. Additionally, streams are bound lazily to the first frame carrying their ID, permitting frames from other sockets to be accepted. This enables remote attackers to bypass server authentication and inject unauthorized streaming frames. The fix in version 1.18.0 rejects streaming frames on server sockets if authentication is incomplete and binds streams strictly to the socket that created them.

Remote attackers can bypass server authentication in Apache bRPC servers configured with authentication and inject or deliver unauthorized streaming frames. This could lead to unauthorized access or manipulation of streaming RPC communications in affected deployments, particularly those exposed to untrusted networks or where foreign connections can impersonate streams by ID.

Upgrade Apache bRPC to version 1.18.0 or later, which includes an official fix that rejects streaming frames on server sockets when authentication has not completed and binds streams to their creating sockets. Alternatively, apply the patch available in the referenced pull request (https://github.com/apache/brpc/pull/3481). No other mitigation is indicated by the vendor advisory.