CVE-2026-78334

Name of the Vulnerable Software and Affected Versions Apache bRPC versions prior to 1.18.0

Description Missing authentication in the streaming RPC path allows a remote attacker to bypass server authentication and inject or deliver streaming frames when a server is configured with an Authenticator. This occurs because streaming RPC frames are consumed directly by the ParseStreamingMessage() function and bypass the authentication hook in InputMessenger. Additionally, server-accepted streams are bound lazily to the first frame carrying their id, potentially allowing a stream to accept a frame from a socket other than the one that created the stream.

Recommendations Upgrade to version 1.18.0.