Apache Thrift CVE-2026-85087

Exploitation requires the Apache Thrift Python bindings (before 0.25.0) to be used as a TLS client/server, and the attacker must hold an active man-in-the-middle position on the network path (reflected by AT:P and AC:H) to present a forged or invalid certificate that the improper validation logic fails to reject. It does not require authentication (PR:N) or user interaction (UI:N), but it is strictly limited to deployments that rely on Thrift's Python TLS transport for trust - systems not using TLS, or already protected by an independent certificate-pinning or network-isolation layer, are not realistically exposed. The need to first intercept the TLS connection is the key limiting factor that constrains real-world risk despite the network attack vector.

This is a moderate, conditional risk rather than an urgent priority. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw, but the high attack complexity (AC:H) and present attack requirements (AT:P) signal that exploitation is not trivial - it depends on the attacker first achieving a privileged man-in-the-middle position on the TLS path, consistent with a CWE-295 improper certificate validation weakness. The vector reports VC:H/VI:H (high confidentiality and integrity impact) with VA:N, matching a scenario where an interceptor can read and tamper with Thrift RPC traffic once the broken validation is abused. All signals point away from mass exploitation: the embedded Exploit Maturity is E:U (unproven/no public exploit), there is no CISA KEV listing and no POC referenced, so this is not confirmed exploited. No standalone EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. There is no conflict between the CVSS vector and the description - both agree on a network-position-dependent MITM weakness - but defenders should treat the base score (6.9) as realistic only where Thrift Python TLS clients/servers are exposed to untrusted network paths.

An attacker positioned on the network path between two systems using the Apache Thrift Python bindings over TLS presents a forged or invalid certificate; because the bindings validate certificates improperly, the connection is accepted instead of rejected. The attacker then transparently intercepts and can modify the Thrift RPC traffic, compromising confidentiality and integrity of exchanged data. No public exploit code is referenced, and the embedded CVSS maturity (E:U) indicates exploitation remains unproven.