# CVE-2026-84748: Apache bRPC improper authorization in protobuf protocol dispatch

Source: https://junglewise.ai/threats/cve-2026-84748-improper-authorization-in-apache-brpc-versions-1-18-0-on-all  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-84748 · Severity: info · Published 2026-10-21

Apache bRPC is a high-performance RPC framework used in distributed systems. A flaw allows remote attackers to bypass authorization controls and invoke builtin services (which expose metrics, flags, and profiler data) through the public port, even though administrators configured these services to be accessible only from an internal port. An attacker on an untrusted network can access sensitive runtime information that should be restricted.

Technologies: [Apache Brpc](https://junglewise.ai/threats/technologies/brpc). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-84748 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84748 being exploited in the wild.

**How severe is CVE-2026-84748?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Apache Brpc before 1.18.0.

**Is there a fix for CVE-2026-84748?** Yes: fixed in 1.18.0. Until then: Ensure the public port is not reachable from untrusted networks, or disable protobuf-based protocols if they are not required and use only HTTP/h2 which has proper authorization enforcement. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84748 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84748?** Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.18.0

Ensure the public port is not reachable from untrusted networks, or disable protobuf-based protocols if they are not required and use only HTTP/h2 which has proper authorization enforcement.

## Technical details

The vulnerability exists in protobuf-based protocol dispatch paths (baidu_std, hulu_pbrpc, sofa_pbrpc, public_pbrpc, nshead_mcpack, nova_pbrpc, ubrpc2pb) where a security_mode flag is computed but never enforced between method resolution and method invocation. While the HTTP/h2 dispatch correctly enforced the internal_port restriction, these pb protocols fail to do so, allowing callers on the public port to invoke builtin services by name and retrieve sensitive information intended for the internal port only.

## Affected products

- Apache bRPC before 1.18.0

## Timeline

- 2026-10-21: disclosed

## References

- [https://github.com/](https://github.com/)
- [https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb](https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb)

## Related threats

- [Apache bRPC MySQL client null pointer dereference](https://junglewise.ai/threats/cve-2026-90484-the-mysql-client-response-parser-in-apache-brpc-dereferences-a)
- [Apache bRPC Discovery naming-service JSON parsing crash](https://junglewise.ai/threats/cve-2026-87849-the-discovery-naming-service-reply-parser-in-apache-brpc-versions)
- [brpc Server authentication bypass via internal_port](https://junglewise.ai/threats/cve-2026-86249-on-a-brpc-server-that-sets-both-serveroptions-auth-and)
- [Apache bRPC path traversal and resource exhaustion in builtin services](https://junglewise.ai/threats/cve-2026-86147-external-control-of-file-name-or-path-and-uncontrolled-resource)
- [Apache bRPC HTTP request/response smuggling in bundled parser](https://junglewise.ai/threats/cve-2026-86146-inconsistent-interpretation-of-http-requests-http-request)