CVE-2026-84748: CWE-285 Improper Authorization in Apache Software Foundation Apache bRPC

CVE-2026-84748 is an improper authorization vulnerability in Apache bRPC versions before 1.18.0. The root cause is that while the internal_port setting is designed to restrict access to builtin and Tabbed services, protobuf-based protocol dispatch paths (including baidu_std, hulu_pbrpc, sofa_pbrpc, and nshead-based protocols) compute but do not enforce the security_mode flag between method resolution and invocation. Since builtin services share the method map with user services, attackers able to reach the public port can invoke builtin services such as brpc.vars or hotspots, potentially disclosing sensitive runtime information like metrics, flags, and profiler data intended to be accessible only via the internal port. This vulnerability requires that the public port is reachable from an untrusted network and that any protobuf-based protocol is enabled on the server.

Remote attackers can bypass intended access controls and invoke builtin services through the public port, leading to unauthorized disclosure of sensitive runtime information such as metrics, flags, and profiler data. This exposure can aid attackers in reconnaissance or further exploitation but does not directly indicate code execution or service disruption.

A fix is available by upgrading Apache bRPC to version 1.18.0, which addresses this improper authorization issue. Alternatively, applying the patch available at https://github.com/apache/brpc/pull/3511 mitigates the vulnerability. Users should ensure that the public port is not exposed to untrusted networks or disable protobuf-based protocols if upgrading or patching is not immediately possible.