CVE-2026-48144
Description
A flaw was found in Apache Thrift c_glib bindings. A remote attacker could exploit an improper validation of certificate with host mismatch vulnerability. This flaw may allow an attacker to intercept and tamper with sensitive data, leading to high confidentiality and integrity impact.
Statement
This vulnerability is rated as Important because an attacker positioned on the network path between a client and server can impersonate arbitrary endpoints to intercept or modify encrypted communications. Although TLS transport is utilized, the c_glib client implementation fails to verify that the server's presented X.509 certificate matches the requested hostname. Exploitation requires an adversary to execute a man-in-the-middle attack and present a valid certificate issued by a trusted Certificate Authority, compromising data confidentiality and integrity.
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
