← All briefs
Brief·2 sources26 Jul 2026

CVE-2026-48145 Exposes Apache Thrift C++ TSSLSocket To Certificate Bypass

vulnerability-disclosurepatch-managementinitial-access

Summary

CVE-2026-48145 is a newly disclosed vulnerability affecting the C++ TSSLSocket component of Apache Thrift in all versions prior to 0.24.0. The flaw resides in the matchName() function and represents an improper validation of certificate with host mismatch, enabling an attacker on the local network to bypass RFC 6125 wildcard certificate validation and circumvent intended access controls.

The vulnerability was publicly disclosed on 24 July 2026 via the oss-security mailing list by Apache Thrift contributor Jens Geyer, with a corresponding VulDB entry published on 26 July 2026 assigning a critical severity rating. At the time of writing, no exploit code is known to exist in the wild, and attack surface is constrained to local network access, partially limiting the immediate risk to internet-exposed deployments.

The recommended remediation is an immediate upgrade to Apache Thrift 0.24.0, which resolves the issue. Organisations running C++ applications built on Apache Thrift 0.23.x or earlier that rely on TLS mutual authentication or certificate-based access control should treat this as a priority patching task, particularly in environments where lateral movement between internal services is a concern.

Timeline

  1. 26 July 2026
    VulDB assigns critical severity rating to CVE-2026-48145
    VulDB published its entry for CVE-2026-48145, rating the vulnerability as critical and confirming that no exploit currently exists, with the attack vector restricted to the local network.
  2. 24 July 2026
    Apache Thrift discloses CVE-2026-48145 on oss-security mailing list
    Jens Geyer of the Apache Thrift project published the formal advisory to oss-security, describing the RFC 6125 wildcard bypass in the C++ TSSLSocket matchName() function and recommending upgrade to version 0.24.0.

Want the full picture?

Each brief contains detailed narrative, impact assessments, technical analysis, IOCs, and response recommendations — available inside the Deltabridge platform.

CVE-2026-48145 Exposes Apache Thrift C++ TSSLSocket To Certificate Bypass — Deltabridge