CVE-2026-48145 is a newly disclosed vulnerability affecting the C++ TSSLSocket component of Apache Thrift in all versions prior to 0.24.0. The flaw resides in the matchName() function and represents an improper validation of certificate with host mismatch, enabling an attacker on the local network to bypass RFC 6125 wildcard certificate validation and circumvent intended access controls.
The vulnerability was publicly disclosed on 24 July 2026 via the oss-security mailing list by Apache Thrift contributor Jens Geyer, with a corresponding VulDB entry published on 26 July 2026 assigning a critical severity rating. At the time of writing, no exploit code is known to exist in the wild, and attack surface is constrained to local network access, partially limiting the immediate risk to internet-exposed deployments.
The recommended remediation is an immediate upgrade to Apache Thrift 0.24.0, which resolves the issue. Organisations running C++ applications built on Apache Thrift 0.23.x or earlier that rely on TLS mutual authentication or certificate-based access control should treat this as a priority patching task, particularly in environments where lateral movement between internal services is a concern.
Each brief contains detailed narrative, impact assessments, technical analysis, IOCs, and response recommendations — available inside the Deltabridge platform.