CVE-2026-48144: Apache Thrift Information Disclosure Flaw

CVE-2026-48144 Overview

CVE-2026-48144 is an Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] in the Apache Thrift c_glib bindings. The flaw affects all versions of Apache Thrift before 0.24.0. The c_glib client bindings fail to properly validate that the hostname presented in an X.509 certificate matches the server the client intended to connect to. An attacker positioned on the network path can present a certificate for a different host and successfully complete the TLS handshake. This defeats the identity-verification guarantee of TLS and enables machine-in-the-middle interception of Thrift RPC traffic.

Critical Impact
Attackers with a network position can impersonate legitimate Thrift servers, intercept RPC traffic, and disclose or manipulate sensitive data exchanged over supposedly authenticated TLS channels.

Affected Products

Apache Thrift versions prior to 0.24.0
Applications using the Apache Thrift c_glib bindings for TLS-enabled RPC
Downstream services and client software statically or dynamically linked against vulnerable c_glib bindings

Discovery Timeline

2026-07-27 - CVE-2026-48144 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-48144

Vulnerability Analysis

Apache Thrift is a widely deployed cross-language RPC framework. The c_glib bindings provide a C/GLib-based client and server implementation used by native applications and services. When these bindings establish a TLS-protected transport, they perform certificate chain validation but do not correctly verify that the certificate's Subject Alternative Name (SAN) or Common Name (CN) matches the hostname the client is connecting to.

Without hostname verification, any certificate signed by a trusted certificate authority — including a legitimately issued certificate for an attacker-controlled domain — can be presented to a Thrift c_glib client. The client accepts the certificate as valid and proceeds with the RPC session. The confidentiality and integrity of the transported data are broken because an on-path adversary can decrypt, read, modify, and re-encrypt Thrift messages in transit.

Root Cause

The root cause is a missing or incomplete hostname verification step in the TLS handshake logic of the c_glib transport. Certificate chain trust is validated, but the peer identity binding — the check that anchors the certificate to the expected server name — is absent. This maps to CWE-297: Improper Validation of Certificate with Host Mismatch.

Attack Vector

Exploitation requires the attacker to occupy a network position between the Thrift client and the intended server. Positions include compromised routers, malicious Wi-Fi access points, DNS spoofing, BGP hijacking, or upstream ISP interception. The attacker terminates the client's TLS connection using any certificate valid under the client's trust store, then relays traffic to the real server. Because the client does not verify hostname, the interception is transparent to the application. No user interaction is required, and authentication is not needed to trigger the flaw.

This vulnerability is described in prose because no verified public proof-of-concept exploit code has been released. Refer to the Apache Mailing List Discussion and the Openwall OSS-Security Update for the vendor's technical description.

Detection Methods for CVE-2026-48144

Indicators of Compromise

TLS sessions from Thrift c_glib clients terminating at IP addresses or SNI values inconsistent with expected backend service inventory.
Unexpected certificate issuers or serial numbers observed on Thrift RPC connections when compared to a known-good baseline.
Sudden latency increases or connection re-establishments to Thrift services, which can indicate proxying by an interception device.

Detection Strategies

Inventory all applications linking against Apache Thrift c_glib bindings and record their versions. Anything below 0.24.0 is vulnerable.
Perform passive TLS certificate logging on egress traffic from services that speak Thrift, and alert on certificate fingerprints that deviate from the expected server certificate.
Use software composition analysis (SCA) tooling against build artifacts and container images to flag vulnerable libthrift_c_glib versions.

Monitoring Recommendations

Ingest TLS handshake metadata (SNI, issuer, subject, SAN) from network sensors into a central analytics platform and correlate against a Thrift service allowlist.
Monitor DNS resolution and routing changes for hosts running Thrift clients, since certificate host mismatch attacks are typically paired with redirection primitives.
Alert on newly issued public-CA certificates for internal Thrift service hostnames using Certificate Transparency log monitoring.

How to Mitigate CVE-2026-48144

Immediate Actions Required

Upgrade Apache Thrift to version 0.24.0 or later in all environments that use the c_glib bindings.
Rebuild and redeploy any application, container image, or package that statically links the vulnerable c_glib library.
Rotate any credentials, tokens, or session material that may have transited a vulnerable Thrift c_glib client over an untrusted network.

Patch Information

Apache has released Apache Thrift 0.24.0, which addresses the improper hostname validation in the c_glib bindings. Users are recommended to upgrade to this version. Refer to the Apache Mailing List Discussion and the Apache Mailing List Thread for the official advisory.

Workarounds

Restrict Thrift c_glib client traffic to trusted network segments where machine-in-the-middle positioning is not feasible until patching completes.
Pin the expected server certificate or public key at the application layer where the c_glib API allows, so that unexpected certificates are rejected regardless of CA trust.
Use a mutual TLS (mTLS) configuration where the server also authenticates the client, reducing the population of hosts that can complete a session.

bash

# Verify installed Apache Thrift c_glib version and upgrade
pkg-config --modversion thrift_c_glib
# Upgrade to fixed release
# Example (source build):
# wget https://downloads.apache.org/thrift/0.24.0/thrift-0.24.0.tar.gz
# tar xzf thrift-0.24.0.tar.gz && cd thrift-0.24.0
# ./configure --with-c_glib && make && sudo make install