Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the public port. (CVE-2026-84748)

The vulnerability in Apache bRPC (versions < 1.18.0) arises from improper enforcement of authorization on protobuf-based protocol dispatch paths. While the internal_port setting is designed to restrict builtin and Tabbed services to internal access, protobuf protocols (including baidu_std, hulu_pbrpc, sofa_pbrpc, and nshead-based protocols) compute but do not enforce the security_mode flag between method resolution and invocation. Since builtin services share the method map with user services, attackers able to reach the public port can invoke builtin services by name, exposing sensitive runtime data that operators intended to restrict to internal access only.

Remote attackers can access builtin services via the public port, leading to unauthorized disclosure of sensitive runtime information such as metrics, flags, and profiler data. This exposure could aid attackers in reconnaissance or further exploitation by revealing internal server state and configuration details.

A fix is available. Users should upgrade Apache bRPC to version 1.18.0, which addresses this improper authorization issue. Alternatively, applying the patch available at https://github.com/apache/brpc/pull/3511 also mitigates the vulnerability. Until patched, ensure that the public port is not reachable from untrusted networks or disable protobuf-based protocols if possible.