CVE-2026-84747

Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass access control rules enforced by a front proxy. Root Cause: The method dispatch function FindMethodPropertyByURI() in bRPC's HTTP protocol splits the request path with a string splitter that skips empty fields, so paths containing empty path segments (consecutive slashes), such as //flags, /flags// and /flags//port, are dispatched to the same method as their collapsed form /flags. Per RFC 3986 these are distinct paths. A front proxy that enforces an ACL (e.g. blocking access to builtin services such as /flags) matches the collapsed form only, and therefore forwards the padded literal to the bRPC server, where it is dispatched as if it were the collapsed form. This differential allows //flags?setvalue= to reach a builtin service that /flags is not allowed to reach. Additionally, the HTTP/2 implementation never validated the :path pseudo-header, so requests without a :path, or with a :path that neither begins with '/' nor is the asterisk-form '*', contrary to RFC 9113 section 8.3.1, were not rejected. Affected Scenarios: Deployments of Apache bRPC behind a front proxy or gateway that performs access control (ACL) decisions on the literal request path, where the bRPC server accepts HTTP or HTTP/2 traffic from that proxy. In such deployments an attacker can send a path containing empty path segments to reach a resource that the front proxy intended to block. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3512 Note: After applying the fix, HTTP and HTTP/2 request paths containing empty path segments (consecutive slashes) are rejected by default, and HTTP/2 :path values that are empty or neither begin with '/' nor equal '*' are rejected. Deployments that depend on the previous lenient behavior can restore it by turning on the gflag -http_allow_empty_path_segments, which is not recommended for servers exposed to untrusted traffic.

• CWE-436

• https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

Published

Oct 21, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84740The Events Calendar WordPress plugin before 6.17.5.1 does no…6.5
• CVE-2026-84741The Events Calendar WordPress plugin before 6.17.5 does not …5.3
• CVE-2026-84742The Events Calendar WordPress plugin before 6.17.5 does not …2.7
• CVE-2026-84743The Events Calendar WordPress plugin before 6.17.5 does not …3.8
• CVE-2026-84744The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does…6.5
• CVE-2026-84745The Events Calendar WordPress plugin before 6.17.3.1 does no…2.7
• CVE-2026-84748Improper authorization in Apache bRPC (versions < 1.18.0) on…7.5
• CVE-2026-84750The Ultra Addons for Contact Form 7 WordPress plugin before …6.5
• CVE-2026-84752Contributor PHP Object Injection in RTMKit <= 2.1.5 versions…8.8
• CVE-2026-84753Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 …9.8
• CVE-2026-84754Unauthenticated Broken Access Control in WPFunnels <= 3.12.1…6.5
• CVE-2026-84755Unauthenticated Broken Access Control in Mail Mint <= 1.31.0…6.5