CVE-2026-86249

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. VerifyHttpRequest() returns true without checking any credential when a built-in service is requested on internal_port, and this verdict is not per - request: verification runs only for the first message of a connection and the result latches the connection. Sending a request such as GET /status to internal_port first authenticates the whole connection, after which every subsequent request dispatched on the same connection is handled without ever calling VerifyHttpRequest(). This lets a remote attacker reach ordinary (non-built-in, non-tabbed) authenticated services without supplying valid credentials whenever the server uses ServerOptions.internal_port together with an Authenticator. The fix restricts internal_port so that it carries only built-in and Tabbed services; requests for ordinary services sent to internal_port are rejected with EPREM / HTTP 403.  Mitigation / Fix: upgrade to 1.18.0 or apply PR https://github.com/apache/brpc/pull/3525 .  Users who rely on serving normal services on internal_port must move those requests to the port passed to Server::Start().

• CWE-287

• https://github.com/apache/brpc/pulls/3525
• https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb

Published

Oct 21, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86243Buffer over-read vulnerability in Apache Tomcat Native durin…7.5
• CVE-2026-86244A security vulnerability has been detected in FastAdmin up t…4.3
• CVE-2026-86245A vulnerability was detected in itsourcecode Sales and Inven…6.3
• CVE-2026-86246Initialization of a resource with an insecure default vulner…9.1
• CVE-2026-86247Race condition within a thread vulnerability in Apache Tomca…7.4
• CVE-2026-86248CLIENT_CERT authentication does not fail as expected for som…9.8
• CVE-2026-8625The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PD…6.4
• CVE-2026-86250h3 versions before 2.0.1-rc.18 fail to validate the chunk co…7.5
• CVE-2026-86251h3 versions before 1.15.9 contain a path traversal vulnerabi…5.9
• CVE-2026-86252h3 versions before 1.15.9 fail to sanitize carriage return c…5.3
• CVE-2026-86253h3 (npm package) versions <= 2.0.1-rc.14 contain a path trav…5.9
• CVE-2026-86254wger versions through master contain an incomplete authoriza…6.8