CVE-2026-84748

Name of the Vulnerable Software and Affected Versions Apache bRPC versions prior to 1.18.0

Description Improper authorization allows remote attackers to access builtin services through the public port. While the ServerOptions.internal port is intended to restrict builtin and Tabbed services to the internal port, protobuf-based protocol dispatch paths (including baidu std, hulu pbrpc, sofa pbrpc, public pbrpc, nshead mcpack, nova pbrpc, and ubrpc2pb) calculate the security mode flag but fail to enforce it between method resolution and invocation. Consequently, clients accessing the public port can invoke builtin services such as brpc.vars or hotspots to disclose sensitive runtime information, including metrics, flags, and profiler data.

Recommendations Update Apache bRPC to version 1.18.0. Apply the official patch for the authorization issue.