CVE-2026-84748: Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration
Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the public port.
Root Cause: ServerOptions.internalport is documented to make builtin services (and Tabbed services) reachable only from the internal port, and the HTTP/h2 dispatch path enforced this. However, all protobuf-based protocol dispatch paths (baidustd, hulupbrpc, sofapbrpc, and the nshead-based protocols publicpbrpc, nsheadmcpack, novapbrpc and ubrpc2pb) computed the securitymode flag but never enforced it between method resolution and method invocation. Since builtin services share the method map with user services, a client able to reach the public port could invoke builtin services such as brpc.vars or hotspots by name over these pb protocols and disclose sensitive runtime information (metrics, flags, profiler data) that the operator intended to expose only via the internal port.
Affected Scenarios: Use a bRPC server with ServerOptions.internalport configured (or with builtin/Tabbed services otherwise expected to be gated by it) while the public port is reachable from an untrusted network and any pb-based protocol is enabled.
How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3511
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache bRPCto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Apache bRPC versions earlier than 1.18.0 are exposed when ServerOptions.internal_port is configured, the public port is reachable from an untrusted network, and a protobuf-based protocol is enabled. Deployments that otherwise rely on the internal port to gate builtin or Tabbed services are also affected under those conditions.
What does an attacker need to exploit this?
An attacker needs network access to the server's public port and must be able to send requests using an enabled protobuf-based protocol. The affected protocols include baidu_std, hulu_pbrpc, sofa_pbrpc, public_pbrpc, nshead_mcpack, nova_pbrpc, and ubrpc2pb.
How can I determine whether my service is affected?
Check whether the bRPC version is earlier than 1.18.0 and whether the public listener is reachable by untrusted clients. Then verify whether any affected protobuf-based protocol is enabled and whether builtin or Tabbed services are intended to be restricted to the internal port.
What information could be exposed?
Builtin services can be invoked by name through the public port, potentially disclosing runtime metrics, flags, and profiler data. Examples of reachable builtin services include brpc.vars and hotspots.