Junglewise Threat Intelligence

CVE-2026-43869: Apache Thrift improper certificate validation in TSSLTransportFactory

CVE-2026-43869 · Severity: high · CVSS 7.3 · Published 2026-05-05

Executive brief

Apache Thrift is a software framework used for scalable cross-language services development. A security flaw in its Java library fails to properly verify that a server's security certificate matches its actual domain name. This could allow an attacker to intercept or tamper with encrypted communications between services, potentially leading to the exposure of sensitive data or unauthorized modification of service traffic.

Technical details

A vulnerability exists in Apache Thrift's Java implementation (specifically within TSSLTransportFactory.java) due to improper validation of certificates with host mismatches (CWE-297). When establishing SSL/TLS connections, the library fails to adequately verify that the hostname of the server matches the identity presented in the certificate. A remote, unauthenticated attacker positioned on the network could exploit this to perform man-in-the-middle (MitM) attacks, intercepting or altering encrypted traffic. This issue affects Apache Thrift versions prior to 0.23.0. Users are advised to upgrade to version 0.23.0 or apply relevant vendor patches for downstream products like Red Hat Multicluster Global Hub.

Affected products

  • Apache Thrift before 0.23.0
  • Red Hat Multicluster Global Hub 1.4.5, 1.5.4, 1.6.2, 1.7.1
  • Red Hat Advanced Cluster Management for Kubernetes 2.13, 2.15, 2.16

Timeline

  • 2026-05-04: disclosed: Initial disclosure on oss-security mailing list
  • 2026-05-05: advisory: NVD publication date
  • 2026-05-28: patched: Red Hat released security updates for Multicluster Global Hub 1.5.4

References

Related threats