Improper validation of certificate with host mismatch in Apache Thrift - CVE-2026-66053

Vulnerability identifier: #VU145199

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-66053

CWE-ID: CWE-297

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass hostname verification in TLS certificate validation.

The vulnerability exists due to improper validation of certificate with host mismatch in the Python TSSLSocket hostname matcher import in Apache Thrift Python bindings when establishing TLS connections. A remote attacker can present a certificate with a mismatched hostname to bypass hostname verification in TLS certificate validation.

Apache Thrift
IBM InfoSphere Information Server
InfoSphere Optim Archive Viewer
IBM Security QRadar Network Threat Analytics
Anolis OS
python3-thrift
thrift
thrift-devel
thrift-glib
thrift-qt
perl-thrift

Install security update from vendor's website.

Apache Thrift - update to 0.24.0
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 3
InfoSphere Optim Archive Viewer - update to 11.7.0.15
python3-thrift - update to 0.24.0-1
thrift - update to 0.24.0-1
thrift-devel - update to 0.24.0-1
thrift-glib - update to 0.24.0-1
thrift-qt - update to 0.24.0-1
perl-thrift - update to 0.24.0-1
IBM Security QRadar Network Threat Analytics - update to 2.0.2

• https://lists.apache.org/api/email.lua?id=m0onjqr2xonn0f49l8vvkjrsx41hvokr
• https://thrift.apache.org/

• Multiple vulnerabilities in Apache Thrift
• Anolis OS update for thrift
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in Network Threat Analytics App for IBM QRadar SIEM
• Multiple vulnerabilities in IBM InfoSphere Optim Archive Viewer