Apache bRPC CVE-2026-48830

Exploitation is possible only when ServerOptions.auth is enabled AND builtin HTTP services are exposed on the public (internet- or client-facing) listener; the attacker must send a builtin HTTP request as the FIRST message on an HTTP/1.1 keep-alive connection, after which later requests on that same socket are mistakenly treated as authenticated. Limiting factors: if builtin services are not exposed on the public listener (a hardening practice), or if authentication is not enabled, the bypass does not apply; the flaw also depends on HTTP/1.1 keep-alive connection reuse. Affected versions are bRPC through 1.17.0; 1.18.0 is not affected.

This is a genuine authentication-bypass flaw (CWE-287) in Apache bRPC through 1.17.0, reported by the Apache project itself, with a confirmed fix in 1.18.0 and a referenced patch PR. However, most risk-scoring signals are ABSENT: no CVSS score or vector was provided, no EPSS exploitation-probability score is available, the CVE is NOT on the CISA KEV list, and no public POC is referenced - so exploitation status is 'no public exploit identified at time of analysis.' Based on the description, the logical attack vector is network-reachable and requires no attacker authentication (an unauthenticated actor performs the bypass), which argues for elevated priority where bRPC is internet-facing. The critical mitigating factor is that exploitation is CONDITIONAL on a specific server configuration - ServerOptions.auth enabled AND builtin HTTP services exposed on the public listener - which meaningfully narrows real-world exposure and suggests this is not a blanket 'default-config' remote compromise. Net assessment: a credible high-impact bypass for affected deployments, but with no evidence of active exploitation or widespread automation, so treat as a prompt-patch item rather than an emergency. Note explicitly: no vendor or NVD CVSS vector exists in the input, so attack complexity and impact are INFERRED from the description, not confirmed.

An attacker reaches a bRPC server that has authentication enabled and builtin HTTP services exposed on a public listener. The attacker opens an HTTP/1.1 keep-alive connection, sends a builtin HTTP request as the first message to make the socket be treated as authenticated, then reuses the same connection to invoke protected non-builtin endpoints without credentials. No public POC is referenced, but the technique is simple and deterministic once the required configuration is present.