In all builds of Apache bRPC older than 1.18.0, the internal port protection intended to gate builtin services is ignored for a range of protobuf‑based protocols. This flaw enables remote attackers to reach the public port and invoke privileged internal services such as brpc.vars or hotspots, exposing runtime metrics, flags, and profiler data that operators expected to be accessible only via an internal network. The result is a direct leakage of sensitive server information.

Apache bRPC version 1.17.x and earlier on any platform that uses ServerOptions.internal_port or otherwise expects builtin/Tabbed services to be gated by this setting. The vulnerability applies when the server’s public port is reachable from untrusted networks and any of the following protobuf protocols is enabled: baidu_std, hulu_pbrpc, sofa_pbrpc, public_pbrpc, nshead_mcpack, nova_pbrpc, or ubrpc2pb.

The CVSS score is not listed, and no EPSS value is available; the flaw is also not in the CISA KEV catalog. Exploitation requires only network connectivity to the bRPC public port and enabling one of the affected protobuf protocols, after which an attacker can freely resolve and invoke internal service methods. This lack of enforced authorization makes the attack straightforward and effective at remote data disclosure.