Apache Thrift CVE-2026-66053

The Python TSSLSocket module must be used for TLS transport. The attacker must be able to intercept and redirect network traffic between the Thrift client and the legitimate server (man-in-the-middle position). No other special configuration is needed; the vulnerability is in the default hostname verification logic. No authentication is bypassed beyond the TLS identity check. User interaction is inherent because the client must connect to what it believes is the legitimate server.

With no CVSS vector supplied in the advisory, a reasonable assessment assigns network vector, high attack complexity due to required MITM positioning, no privileges, and user interaction (client connects). Without EPSS or KEV data, the real-world risk is tempered by the high barrier of intercepting network traffic. The vulnerability is not reported as actively exploited. The implied impact is high confidentiality and integrity loss but no availability impact. The lack of CVSS, EPSS, and KEV information means risk must be estimated; for typical internal Thrift deployments, exposure may be low, but for public-facing services, it could be significant if clients are vulnerable. Contrast with broader TLS libraries where such flaws are rare and quickly patched.

An attacker positioned on the network path between a Thrift client and server (e.g., via ARP spoofing, compromised router, or DNS cache poisoning) redirects the TLS connection to an attacker-controlled endpoint. The attacker presents a valid TLS certificate for an arbitrary domain. The client’s TSSLSocket accepts the connection without verifying that the certificate’s hostname matches the intended server, so the attacker can decrypt, read, and modify all subsequent RPC messages.