Quick answers
- Is CVE-2026-84748 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84748 being exploited in the wild.
- How severe is CVE-2026-84748?
- Informational severity, published 21 October 2026.
- Which products and versions are affected?
- Apache Brpc before 1.18.0.
- Is there a fix for CVE-2026-84748?
- Yes: fixed in 1.18.0. Until then: Ensure the public port is not reachable from untrusted networks, or disable protobuf-based protocols if they are not required and use only HTTP/h2 which has proper authorization enforcement. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-84748 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-84748?
- Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.18.0
Ensure the public port is not reachable from untrusted networks, or disable protobuf-based protocols if they are not required and use only HTTP/h2 which has proper authorization enforcement.
Technical details
The vulnerability exists in protobuf-based protocol dispatch paths (baidu_std, hulu_pbrpc, sofa_pbrpc, public_pbrpc, nshead_mcpack, nova_pbrpc, ubrpc2pb) where a security_mode flag is computed but never enforced between method resolution and method invocation. While the HTTP/h2 dispatch correctly enforced the internal_port restriction, these pb protocols fail to do so, allowing callers on the public port to invoke builtin services by name and retrieve sensitive information intended for the internal port only.
Affected products
- Apache bRPC before 1.18.0
Timeline
- 2026-10-21: disclosed