{"id":"CVE-2026-48830","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-48830","generatedAt":"2026-10-28T01:39:51.546Z","title":"Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection.","description":"Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection.\n\nWhen ServerOptions.auth is enabled and builtin HTTP services are exposed on the public listener, a builtin request received as the first message on a socket may cause the connection to be treated as authenticated for later requests on that socket. Users are recommended to upgrade to version 1.18.0, which fixes this issue, or apply this PR separately:  https://github.com/apache/brpc/pull/3308","published":"2026-10-21T12:17:21.000Z","lastModified":"2026-10-26T21:10:00.000Z","status":"Deferred","sourceIdentifier":"security@apache.org","cvss":null,"cwe":["CWE-287"],"affected":[],"epss":{"score":0.00263,"percentile":0.18048,"date":"2026-10-26","history":[{"date":"2026-10-22","score":0.00263,"percentile":0.17218}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"unknown","text":"Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-21T12:17:21.000Z","detail":{"score":null,"severity":null,"publishedAt":"2026-10-21T12:17:20.910Z"},"summary":"New CVE, not yet scored."}],"references":[{"url":"https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb","source":"security@apache.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-48830","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}