Apache Thrift CVE-2026-85086

Exploitation requires the application to use the Apache Thrift Perl bindings for TLS/SSL-protected RPC AND an attacker able to intercept that connection (an active man-in-the-middle position), which is why the vendor vector sets AT:P. The root cause is twofold: improper peer-certificate validation (CWE-295) combined with an insecure default initialization that leaves verification effectively disabled unless the operator overrides it. Exploitation is unauthenticated (PR:N, UI:N) against vulnerable versions (all releases before 0.25.0), but is LIMITED by the need for a network interception vantage point and by applicability only to deployments that actually use the Perl bindings over TLS; clients that do not use TLS, or that already enforce certificate verification at another layer, are not meaningfully exposed. Upgrading to 0.25.0 remediates the flaw.

This is a moderate, conditionally-exploitable TLS trust flaw rather than a drop-everything emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N) describes an unauthenticated, network-reachable issue with high confidentiality and integrity impact but a required attack precondition (AT:P) - consistent with an improper-certificate-validation (CWE-295) weakness that only pays off when an attacker already holds a man-in-the-middle position on the TLS path. The E:U value explicitly signals exploit maturity 'Unreported', and there is no CISA KEV listing and no POC referenced, so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be compared here. The signals are internally consistent: a 6.9 (Medium) score with an attack-requirement caveat and unproven exploitation points to a genuine-but-gated risk - dangerous for anyone running the Perl bindings over untrusted networks, but not a mass-exploitable remote-code-execution class issue. The key limiting factor (need for an interception position) is confirmed by the CVSS AT:P metric and the CWE-295 classification; the absence of EPSS and the niche Perl-binding scope are the main data gaps affecting prioritization.

An attacker positioned on the network path (e.g., a rogue Wi-Fi/gateway, ARP-spoofed LAN segment, or compromised upstream router) between a Thrift Perl client and its server presents a forged or self-signed TLS certificate. Because the Perl bindings fail to validate the peer certificate - and ship with an insecure default that does not enforce verification - the client accepts the connection and the attacker transparently decrypts, reads, and tampers with the RPC traffic. No public exploit code is identified, and success requires the attacker to already hold an interception position (CVSS AT:P).