# CVE-2026-86147: Apache bRPC path traversal and resource exhaustion in builtin services

Source: https://junglewise.ai/threats/cve-2026-86147-external-control-of-file-name-or-path-and-uncontrolled-resource  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-86147 · Severity: info · Published 2026-10-21

Apache bRPC is a remote procedure call library used to build distributed services. An attacker with network access to the builtin service port can create arbitrary directories, overwrite files as the server process, or exhaust CPU resources by triggering indefinite profiling operations. This affects all bRPC servers exposing builtin services (the default configuration) to untrusted networks.

Technologies: [Apache Brpc](https://junglewise.ai/threats/technologies/brpc). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-86147 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86147 being exploited in the wild.

**How severe is CVE-2026-86147?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Apache Brpc before 1.18.0.

**Is there a fix for CVE-2026-86147?** Yes: fixed in 1.18.0. Until then: Restrict network access to the builtin service port to trusted clients only, or disable the builtin services if they are not required for operation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86147 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86147?** Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.18.0

Restrict network access to the builtin service port to trusted clients only, or disable the builtin services if they are not required for operation.

## Technical details

The vulnerability has two root causes: (1) The /flags service accepts runtime modification of bvar dump path gflags without validation, allowing directory traversal via path injection and '..' sequences in tab names; an attacker can trigger recursive directory creation and file truncation at arbitrary locations. (2) The /pprof service does not enforce the max_profiling_seconds limit on the ?seconds= parameter, allowing an attacker to hold the process-wide CPU or contention profiler indefinitely with a single request like ?seconds=2147483647. Both require network access to the builtin service port but no authentication.

## Affected products

- Apache bRPC before 1.18.0

## Timeline

- 2026-10-21: disclosed

## Related threats

- [Apache bRPC MySQL client null pointer dereference](https://junglewise.ai/threats/cve-2026-90484-the-mysql-client-response-parser-in-apache-brpc-dereferences-a)
- [Apache bRPC Discovery naming-service JSON parsing crash](https://junglewise.ai/threats/cve-2026-87849-the-discovery-naming-service-reply-parser-in-apache-brpc-versions)
- [brpc Server authentication bypass via internal_port](https://junglewise.ai/threats/cve-2026-86249-on-a-brpc-server-that-sets-both-serveroptions-auth-and)
- [Apache bRPC HTTP request/response smuggling in bundled parser](https://junglewise.ai/threats/cve-2026-86146-inconsistent-interpretation-of-http-requests-http-request)
- [Apache bRPC improper authorization in protobuf protocol dispatch](https://junglewise.ai/threats/cve-2026-84748-improper-authorization-in-apache-brpc-versions-1-18-0-on-all)