Is CVE-2026-41607 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41607 being exploited in the wild.

How severe is CVE-2026-41607?

Medium severity, with a CVSS score of 6.5, published 28 April 2026.

Which products and versions are affected?

Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2.

Is there a fix for CVE-2026-41607?

A patch was published on 2026-05-07: Red Hat released security advisory RHSA-2026:14885 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41607 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41607?

Check whether you run Apache Thrift or Red Hat Multicluster Global Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41607: Apache Thrift out-of-bounds read in C++ JSON implementation

CVE-2026-41607 · Severity: medium · CVSS 6.5 · Published 2026-04-28

Apache Thrift, a framework for scalable cross-language services development, is vulnerable to a memory handling flaw. An attacker can exploit this to read sensitive information from the system's memory or cause the service to crash, leading to a denial of service. This affects various enterprise products that integrate Thrift, including Red Hat OpenShift and Advanced Cluster Management.

Technologies: Apache Thrift, Red Hat Multicluster Global Hub. Vendors: Apache, Red Hat.

Quick answers

Is CVE-2026-41607 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41607 being exploited in the wild.
How severe is CVE-2026-41607?: Medium severity, with a CVSS score of 6.5, published 28 April 2026.
Which products and versions are affected?: Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2.
Is there a fix for CVE-2026-41607?: A patch was published on 2026-05-07: Red Hat released security advisory RHSA-2026:14885 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41607 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41607?: Check whether you run Apache Thrift or Red Hat Multicluster Global Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) read vulnerability exists in Apache Thrift's C++ JSON protocol implementation. The flaw occurs when the library processes specially crafted input, failing to properly validate memory access boundaries. A remote, unauthenticated attacker can exploit this via the network to access memory outside of allocated buffers. This can result in the disclosure of sensitive information or trigger a crash (Denial of Service). The issue is resolved in Apache Thrift version 0.23.0. Red Hat has also issued several security advisories (e.g., RHSA-2026:14885) for downstream products incorporating the vulnerable library.

Affected products

Apache Thrift before 0.23.0
Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2
Red Hat Advanced Cluster Management for Kubernetes 2.15
Red Hat OpenShift distributed tracing 3.9.3
Red Hat Enterprise Linux AI (RHEL AI) 3
Red Hat OpenShift Container Platform 4

Timeline

2026-04-27: disclosed: Initial disclosure on oss-security mailing list
2026-04-28: advisory: NVD publication date
2026-05-07: patched: Red Hat released security advisory RHSA-2026:14885

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.