CVE-2026-48830: Apache bRPC 0 through 1.17.0

Affected technology

Apache bRPC · 0 through 1.17.0
Apache Software Foundation

Description’s affected range: through 1.17.0

Component: Not specified by the source

What an attacker can do

A remote unauthenticated attacker can bypass authentication for protected non-builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection.

Published 21-Oct-2026 16:14 UTC

CWE: CWE-287
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-21 16:14:50.830645+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-21 16:09:05.633125+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-48830.html