Apache Thrift c_glib EUVD-2026-49148

The client must be using the Apache Thrift c_glib TLS transport (TSocket with SSL/TLS) and connecting to a server over a network path that the attacker can intercept. No user interaction or authentication is required for the vulnerability itself; the client will automatically and silently fail to verify the hostname. The attack does not require any non-default configuration beyond enabling TLS transport, which is a standard feature. The attacker must be in a man-in-the-middle position, which could be achieved via ARP spoofing on a local network, compromise of a network infrastructure device, or by serving as a malicious proxy.

The vulnerability has a likely CVSS 3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting a network-exposed attack with high complexity because exploitation requires an active man-in-the-middle position. No EPSS score is available, but such vulnerabilities are typically not widely exploited automatically because of the prerequisite network position. The issue is not listed in CISA KEV and no proof-of-concept is known, suggesting low immediate risk. However, for deployments using Apache Thrift with c_glib over TLS, this represents a severe confidentiality and integrity risk if attackers can position themselves on the network path. The attack is automatable once an adversary achieves a privileged network position. The overall real-world risk is moderate, with a high potential impact but a high barrier to exploitation.

An attacker with control of a network segment between a Thrift c_glib client and a legitimate TLS server presents a valid certificate issued to a domain they own. The client accepts the certificate without verifying that the server it connected to is the one identified in the certificate. The attacker can then decrypt, read, and modify all Thrift RPC messages, potentially stealing data or injecting malicious commands.