Security readout for executives and security teams
Plain-English summary
Apache Thrift's c_glib TLS client may accept a valid certificate issued for the wrong hostname. An attacker able to intercept network traffic could impersonate a trusted service, exposing or altering sensitive communications. Apache rates affected releases before 0.24.0 as vulnerable and recommends upgrading.
Executive priority
Treat this as urgent where c_glib clients protect sensitive or privileged communications. Establish exposure promptly and upgrade affected deployments. The critical score reflects potentially severe confidentiality and integrity loss, although exploitation requires a difficult traffic-interception scenario and active exploitation is not established.
Technical view
CVE-2026-48144 is a CWE-297 hostname-verification failure in Apache Thrift c_glib TLS clients before 0.24.0. The CVSS 4.0 score is 9.1 with network reachability, high attack complexity, no privileges or user interaction, and high confidentiality and integrity impact without availability impact.
Likely exposure
Exposure is limited to applications using Apache Thrift c_glib TLS client bindings from releases before 0.24.0. Systems not using these bindings or not making TLS client connections are not shown as affected by the supplied evidence.
Exploitation context
The issue could enable service impersonation when an attacker can intercept traffic and present an otherwise trusted certificate for a different hostname. High attack complexity reduces routine exploitability. KEV is false, and the supplied sources provide no evidence of active exploitation.
Researcher notes
The CVSS vector is CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Scope is specifically the c_glib TLS client hostname check; the supplied evidence does not establish impacts in other Thrift language bindings. Version 0.24.0 is the documented fix.
Mitigation direction
- Upgrade affected Apache Thrift c_glib deployments to version 0.24.0 or later.
- Inventory applications and dependencies for Apache Thrift versions before 0.24.0.
- Prioritize clients carrying credentials, personal data, administrative traffic, or security-sensitive messages.
- Review Apache vendor advisories for any environment-specific upgrade guidance.
Validation and detection
- Confirm the deployed Apache Thrift version and whether c_glib TLS client bindings are used.
- Identify outbound Thrift TLS connections and the sensitivity of data they carry.
- Verify production artifacts no longer contain Apache Thrift releases before 0.24.0.
- In a controlled test, confirm connections reject certificates whose hostname does not match the destination.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-297: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-48144 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——apacheVulnerability scoring details
Base CVSS 4.0 score
9.1CriticalVector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9CVE reference, apache · vendor-advisory
- https://lists.apache.org/thread/2xoltfxgzf5jyhcwq6y07spts5cn6ppjCVE reference, apache · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Validation of Certificate with Host Mismatch
Improper Validation of Certificate with Host Mismatch represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.