CVE-2026-86249: CWE-287 Improper Authentication in Apache Software Foundation Apache bRPC

The vulnerability arises because VerifyHttpRequest() returns true without credential checks when a built-in service is requested on the internal_port, and this authentication result is cached for the entire connection. An attacker can send a request such as GET /status to the internal_port first, which authenticates the connection, then access ordinary authenticated services without valid credentials on subsequent requests over the same connection. The fix in Apache bRPC 1.18.0 restricts internal_port usage to built-in and Tabbed services only and rejects ordinary service requests to internal_port with an error response. Users relying on serving normal services on internal_port must move those services to the port passed to Server::Start().

Remote attackers can bypass authentication entirely on Apache bRPC servers configured with both ServerOptions.auth and ServerOptions.internal_port, gaining unauthorized access to ordinary authenticated services. This could lead to unauthorized information disclosure or unauthorized actions depending on the services exposed. The vulnerability affects all versions prior to 1.18.0 that use this configuration.

Upgrade Apache bRPC to version 1.18.0 or later, which includes the official fix restricting internal_port to built-in and Tabbed services and rejecting ordinary service requests on that port. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3525. Users should also ensure that normal services are not served on internal_port but instead on the port passed to Server::Start().