# CVE-2026-66392: Apache bRPC TLS certificate validation bypass

Source: https://junglewise.ai/threats/cve-2026-66392-apache-brpc-versions-before-1-18-0-validate-the-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-66392 · Severity: info · Published 2026-10-21

Apache bRPC is a high-performance remote procedure call framework used for service-to-service communication. Versions before 1.18.0 fail to validate that a TLS certificate belongs to the intended server, allowing an attacker on the network to intercept connections and impersonate legitimate endpoints using a certificate from a trusted CA. This could enable unauthorized access to backend services or data interception.

Technologies: [Apache Brpc](https://junglewise.ai/threats/technologies/brpc). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-66392 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66392 being exploited in the wild.

**How severe is CVE-2026-66392?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Apache Brpc before 1.18.0.

**Is there a fix for CVE-2026-66392?** Yes: fixed in Apache bRPC 1.18.0. Until then: Upgrade to Apache bRPC 1.18.0 and enable VERIFY_PEER with a positive verify_depth. HTTPS Channels automatically verify the certificate against the host in the Channel URL, or explicitly set VerifyOptions::expected_peer_name when the certificate identity differs from the URL host. Alternatively, apply the patch from https://github.com/apache/brpc/pull/3408 . Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-66392 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-66392?** Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Apache bRPC 1.18.0

Upgrade to Apache bRPC 1.18.0 and enable VERIFY_PEER with a positive verify_depth. HTTPS Channels automatically verify the certificate against the host in the Channel URL, or explicitly set VerifyOptions::expected_peer_name when the certificate identity differs from the URL host. Alternatively, apply the patch from https://github.com/apache/brpc/pull/3408 .

## Technical details

The vulnerability is a TLS certificate validation bypass in bRPC's peer verification mechanism. When client TLS peer verification is enabled, the library validates the certificate chain but does not bind the certificate to the expected DNS name or IP address via SAN verification. An attacker with network access and a certificate from a CA trusted by the client can perform a man-in-the-middle attack. The fix requires upgrading to 1.18.0 with VERIFY_PEER and positive verify_depth, or applying the mitigation patch that implements DNS/IP SAN verification during the TLS handshake.

## Affected products

- Apache bRPC before 1.18.0

## Timeline

- 2026-10-21: disclosed

## References

- [https://github.com/](https://github.com/)
- [https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb](https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb)

## Related threats

- [Apache bRPC MySQL client null pointer dereference](https://junglewise.ai/threats/cve-2026-90484-the-mysql-client-response-parser-in-apache-brpc-dereferences-a)
- [Apache bRPC Discovery naming-service JSON parsing crash](https://junglewise.ai/threats/cve-2026-87849-the-discovery-naming-service-reply-parser-in-apache-brpc-versions)
- [brpc Server authentication bypass via internal_port](https://junglewise.ai/threats/cve-2026-86249-on-a-brpc-server-that-sets-both-serveroptions-auth-and)
- [Apache bRPC path traversal and resource exhaustion in builtin services](https://junglewise.ai/threats/cve-2026-86147-external-control-of-file-name-or-path-and-uncontrolled-resource)
- [Apache bRPC HTTP request/response smuggling in bundled parser](https://junglewise.ai/threats/cve-2026-86146-inconsistent-interpretation-of-http-requests-http-request)