Quick answers
- Is CVE-2026-86147 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86147 being exploited in the wild.
- How severe is CVE-2026-86147?
- Informational severity, published 21 October 2026.
- Which products and versions are affected?
- Apache Brpc before 1.18.0.
- Is there a fix for CVE-2026-86147?
- Yes: fixed in 1.18.0. Until then: Restrict network access to the builtin service port to trusted clients only, or disable the builtin services if they are not required for operation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86147 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-86147?
- Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.18.0
Restrict network access to the builtin service port to trusted clients only, or disable the builtin services if they are not required for operation.
Technical details
The vulnerability has two root causes: (1) The /flags service accepts runtime modification of bvar dump path gflags without validation, allowing directory traversal via path injection and '..' sequences in tab names; an attacker can trigger recursive directory creation and file truncation at arbitrary locations. (2) The /pprof service does not enforce the max_profiling_seconds limit on the ?seconds= parameter, allowing an attacker to hold the process-wide CPU or contention profiler indefinitely with a single request like ?seconds=2147483647. Both require network access to the builtin service port but no authentication.
Affected products
- Apache bRPC before 1.18.0
Timeline
- 2026-10-21: disclosed