CVE-2026-48145: Apache Thrift Information Disclosure Flaw

CVE-2026-48145 Overview

CVE-2026-48145 is an improper certificate validation flaw in the Apache Thrift C++ bindings. The vulnerability stems from a host mismatch during TLS certificate verification, tracked as [CWE-297]. Applications built on the affected C++ client bindings can accept certificates that do not match the requested hostname. This weakness enables network-positioned attackers to impersonate legitimate Thrift services and intercept remote procedure calls. All Apache Thrift releases prior to 0.24.0 are affected. The Apache Thrift project has published version 0.24.0 to remediate the issue.

Critical Impact
Attackers with network access can perform man-in-the-middle attacks against TLS-protected Thrift RPC traffic, breaking confidentiality of data in transit.

Affected Products

Apache Thrift C++ bindings, all versions before 0.24.0
Applications and services embedding vulnerable Thrift C++ client libraries
RPC deployments relying on Thrift TLS transport for authentication

Discovery Timeline

2026-07-27 - CVE-2026-48145 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-48145

Vulnerability Analysis

Apache Thrift is a cross-language RPC framework that supports TLS-secured transports. The C++ client bindings implement certificate validation during the TLS handshake to verify the identity of the remote server. In releases before 0.24.0, the bindings do not correctly compare the certificate subject or Subject Alternative Name against the requested hostname. A certificate that chains to a trusted authority but was issued for a different host is accepted as valid. This defeats the primary purpose of hostname verification in TLS.

The network attack vector requires the adversary to reach the client-server path and present a certificate that is trusted but not bound to the target hostname. Successful exploitation compromises the confidentiality of RPC payloads, including credentials, tokens, and application data serialized over Thrift protocols such as TBinaryProtocol or TCompactProtocol.

Root Cause

The root cause is missing or incorrect hostname verification logic in the C++ TLS transport implementation. Certificate chain validation succeeds, but the code path that binds the peer certificate identity to the connection's requested hostname is not enforced. This is a classic [CWE-297] Improper Validation of Certificate with Host Mismatch condition.

Attack Vector

An attacker positioned in the network path, such as through Address Resolution Protocol (ARP) spoofing, Border Gateway Protocol (BGP) hijacking, or a compromised router, redirects Thrift client traffic to an attacker-controlled endpoint. The attacker presents a valid certificate issued for a domain they legitimately control, or a certificate obtained from a permissive certificate authority. The vulnerable client completes the TLS handshake and streams RPC data to the attacker. The attacker can proxy traffic to the real server to maintain a transparent man-in-the-middle position. Refer to the Apache Mailing List Discussion for vendor-supplied technical details.

Detection Methods for CVE-2026-48145

Indicators of Compromise

Unexpected TLS certificates observed on Thrift client sessions, where the certificate common name or Subject Alternative Name does not match the intended service hostname.
Anomalous DNS responses or ARP table changes preceding Thrift RPC sessions.
New or unrecognized intermediate proxies appearing in the network path between Thrift clients and servers.

Detection Strategies

Inventory all applications linking against Apache Thrift C++ libraries at versions below 0.24.0 using software composition analysis.
Inspect TLS handshake metadata in network telemetry and alert when Thrift RPC endpoints negotiate with certificates issued for unexpected hostnames.
Deploy TLS interception detection to flag session establishment with certificates chained to unusual or newly observed certificate authorities.

Monitoring Recommendations

Forward TLS session logs and Thrift application logs to a centralized SIEM for correlation of certificate anomalies with RPC failures.
Monitor package management events on production hosts for updates to the thrift C++ runtime and libraries.
Track outbound RPC destinations against an allowlist and alert on deviations that could indicate traffic redirection.

How to Mitigate CVE-2026-48145

Immediate Actions Required

Upgrade Apache Thrift to version 0.24.0 or later across all C++ client and server deployments.
Rebuild and redeploy any statically linked applications that embed the vulnerable Thrift C++ bindings.
Rotate credentials and API tokens that may have traversed Thrift TLS sessions on vulnerable clients.

Patch Information

The Apache Thrift project fixed the issue in release 0.24.0. Refer to the Apache Mailing List Discussion, the Apache Mailing List Update, and the OpenWall OSS Security Thread for release details and upstream patch discussion.

Workarounds

Restrict Thrift RPC traffic to trusted network segments using mutual TLS with pinned server certificates verified at the application layer.
Implement certificate pinning in wrapping application code to enforce hostname-to-certificate binding independently of the vulnerable library.
Route Thrift traffic through an authenticated service mesh sidecar that performs correct hostname verification before forwarding requests.

bash

# Configuration example
# Verify installed Apache Thrift version and upgrade to 0.24.0 or later
thrift --version
# Example package upgrade on Debian-based systems after distribution update
sudo apt-get update && sudo apt-get install --only-upgrade libthrift-dev thrift-compiler