Is CVE-2026-86249 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86249 being exploited in the wild.

How severe is CVE-2026-86249?

Informational severity, published 21 October 2026.

How is CVE-2026-86249 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86249?

Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86249: brpc Server authentication bypass via internal_port

CVE-2026-86249 · Severity: info · Published 2026-10-21

Apache brpc is a remote procedure call framework used to build distributed services. When a brpc server is configured with both authentication and an internal_port, attackers can bypass authentication entirely by sending a built-in service request (like /status) to the internal port first, which exempts the entire connection from credential checks. Subsequent requests on the same connection reach authenticated services without providing valid credentials, allowing unauthorized access to sensitive operations.

Technologies: Apache Brpc. Vendors: Apache.

Quick answers

Is CVE-2026-86249 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86249 being exploited in the wild.
How severe is CVE-2026-86249?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Apache Brpc before 1.18.0.
Is there a fix for CVE-2026-86249?: Yes: fixed in 1.18.0. Until then: Users relying on normal services on internal_port must move those requests to the primary port passed to Server::Start(). Alternatively, apply the fix from PR #3525 before upgrading.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-21"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86249 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86249?: Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.18.0

Users relying on normal services on internal_port must move those requests to the primary port passed to Server::Start(). Alternatively, apply the fix from PR #3525 before upgrading.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-21"}]

Technical details

The vulnerability exists in VerifyHttpRequest(), which returns true for built-in services on internal_port without checking credentials, and this verdict is cached per-connection rather than per-request. A remote attacker can send a built-in service request to internal_port first to authenticate the connection, then send requests for ordinary (non-built-in) authenticated services on the same connection without ever invoking credential verification. The fix restricts internal_port to carry only built-in and tabbed services, rejecting requests for ordinary services with HTTP 403.

Affected products

Apache brpc before 1.18.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.