{"cvss":7.3,"datePublished":"2026-05-05T08:16:01.063","dateUpdated":"2026-10-26T19:10:00.163","description":"Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.","id":"CVE-2026-43869","raw":{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Apache Thrift","vendor":"Apache Software Foundation","versions":[{"lessThan":"0.23.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@apache.org"},{"affectedData":[{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:cryostat:4::el9"],"defaultStatus":"affected","packageName":"cryostat/cryostat-storage-rhel9","product":"Cryostat 4 on RHEL 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.2.0-16","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"],"defaultStatus":"unaffected","packageName":"libthrift","product":"Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1","vendor":"Red Hat"},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:multicluster_globalhub:1.3::el9"],"defaultStatus":"affected","packageName":"multicluster-globalhub/multicluster-globalhub-grafana-rhel9","product":"Multicluster Global Hub 1.3.4","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1779212259","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:multicluster_globalhub:1.4::el9"],"defaultStatus":"affected","packageName":"multicluster-globalhub/multicluster-globalhub-grafana-rhel9","product":"Multicluster Global Hub 1.4.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1779579439","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:multicluster_globalhub:1.6::el9"],"defaultStatus":"affected","packageName":"multicluster-globalhub/multicluster-globalhub-grafana-rhel9","product":"Multicluster Global Hub 1.6.5","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1780167118","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:multicluster_globalhub:1.7::el9"],"defaultStatus":"affected","packageName":"multicluster-globalhub/multicluster-globalhub-grafana-rhel9","product":"Multicluster Global Hub 1.7.0","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1779925273","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.13::el9"],"defaultStatus":"affected","packageName":"rhacm2/acm-grafana-rhel9","product":"Red Hat Advanced Cluster Management for Kubernetes 2.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782383730","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.14::el9"],"defaultStatus":"affected","packageName":"rhacm2/acm-grafana-rhel9","product":"Red Hat Advanced Cluster Management for Kubernetes 2.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1782693386","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.15::el9"],"defaultStatus":"affected","packageName":"rhacm2/acm-grafana-rhel9","product":"Red Hat Advanced Cluster Management for Kubernetes 2.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1780677003","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:acm:2.16::el9"],"defaultStatus":"affected","packageName":"rhacm2/acm-grafana-rhel9","product":"Red Hat Advanced Cluster Management for Kubernetes 2.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1780926805","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:multicluster_globalhub:1.5::el9"],"defaultStatus":"affected","packageName":"multicluster-globalhub/multicluster-globalhub-grafana-rhel9","product":"Red Hat multicluster global hub 1.5.3","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1778867753","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:2.25::el9"],"defaultStatus":"affected","packageName":"rhoai/odh-modelmesh-rhel9","product":"Red Hat OpenShift AI 2.25","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1783443816","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_distributed_tracing:3.10::el9"],"defaultStatus":"affected","packageName":"rhosdt/tempo-rhel9","product":"Red Hat OpenShift distributed tracing 3.10.2","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1781589494","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:multicluster_globalhub"],"defaultStatus":"affected","packageName":"multicluster-globalhub/multicluster-globalhub-grafana-rhel8","product":"Multicluster Global Hub","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:service_mesh:2"],"defaultStatus":"unaffected","packageName":"openshift-service-mesh/istio-rhel8-operator","product":"OpenShift Service Mesh 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:acm:2"],"defaultStatus":"unaffected","packageName":"redhat-user-workloads/grafana-acm-212","product":"Red Hat Advanced Cluster Management for Kubernetes 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:acm:2"],"defaultStatus":"affected","packageName":"redhat-user-workloads/grafana-acm-213","product":"Red Hat Advanced Cluster Management for Kubernetes 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaiis/vllm-cpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ai_inference_server:3"],"defaultStatus":"affected","packageName":"rhaiis/vllm-tpu-rhel9","product":"Red Hat AI Inference Server","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:camel_quarkus:3"],"defaultStatus":"affected","packageName":"libthrift","product":"Red Hat build of Apache Camel 4 for Quarkus 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_data_grid:8"],"defaultStatus":"unaffected","packageName":"libthrift","product":"Red Hat Data Grid 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"grafana","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"],"defaultStatus":"affected","packageName":"libthrift","product":"Red Hat Fuse 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"],"defaultStatus":"unaffected","packageName":"libthrift","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-modelmesh-rhel8","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"],"defaultStatus":"unaffected","packageName":"rhoai/odh-model-registry-rhel9","product":"Red Hat OpenShift AI (RHOAI)","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/cnf-tests-rhel8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/oc-mirror-plugin-rhel9","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"openshift4/ztp-site-generate-rhel8","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"redhat-user-workloads/cnf-tests-4-15","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"redhat-user-workloads/ztp-site-generate-4-15","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"redhat-user-workloads/ztp-site-generate-4-16","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_distributed_tracing:3"],"defaultStatus":"affected","packageName":"rhosdt/opentelemetry-collector-rhel9","product":"Red Hat OpenShift distributed tracing 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_distributed_tracing:3"],"defaultStatus":"affected","packageName":"rhosdt/tempo-jaeger-query-rhel9","product":"Red Hat OpenShift distributed tracing 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_distributed_tracing:3"],"defaultStatus":"affected","packageName":"rhosdt/tempo-query-rhel9","product":"Red Hat OpenShift distributed tracing 3","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openstack:18.0"],"defaultStatus":"unaffected","packageName":"rhoso-operators/openstack-operator-bundle","product":"Red Hat OpenStack Platform 18.0","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*","matchCriteriaId":"0CE7604A-DA43-44E3-9840-9E3696223DD5","versionEndExcluding":"0.23.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue."},{"lang":"es","value":"Vulnerabilidad de validación incorrecta de certificado con desajuste de host en Apache Thrift.\n\nEste problema afecta a Apache Thrift: antes de 0.23.0.\n\nSe recomienda a los usuarios actualizar a la versión 0.23.0, que soluciona el problema."}],"id":"CVE-2026-43869","lastModified":"2026-10-26T19:10:00.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-43869","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-06T13:01:36.994667Z","version":"2.0.3"}}]},"published":"2026-05-05T08:16:01.063","references":[{"source":"security@apache.org","tags":["Vendor Advisory"],"url":"https://lists.apache.org/thread/3hsgl1b69wzq3ry39scqbv2dhyl3j52r"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/05/05/3"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:21769"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:22347"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:22423"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23345"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24503"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24539"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25273"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:26586"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:27126"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:28010"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:30651"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:36882"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-43869"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466660"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43869.json"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-297"}],"source":"security@apache.org","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-295"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]},"severity":"HIGH","source":"nvd","title":"Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.\n\nThis issue affects Apache Thri..."}