CVE-2026-43869

HighCVSS 7.3/10Last modified Oct 26, 2026

Description

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-297CWE-295

Affected software

VendorProductVersions
Apache Software FoundationApache Thrift< 0.23.0
Red HatCryostat 4 on RHEL 9—
Red HatRed Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1—
Red HatMulticluster Global Hub 1.3.4—
Red HatMulticluster Global Hub 1.4.5—
Red HatMulticluster Global Hub 1.6.5—
Red HatMulticluster Global Hub 1.7.0—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.13—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.14—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.15—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2.16—
Red HatRed Hat multicluster global hub 1.5.3—
Red HatRed Hat OpenShift AI 2.25—
Red HatRed Hat OpenShift distributed tracing 3.10.2—
Red HatMulticluster Global Hub—
Red HatOpenShift Service Mesh 2—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2—
Red HatRed Hat Advanced Cluster Management for Kubernetes 2—
Red HatRed Hat AI Inference Server—
Red HatRed Hat AI Inference Server—
Red HatRed Hat build of Apache Camel 4 for Quarkus 3—
Red HatRed Hat Data Grid 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Fuse 7—
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift AI (RHOAI)—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift distributed tracing 3—
Red HatRed Hat OpenShift distributed tracing 3—
Red HatRed Hat OpenShift distributed tracing 3—
Red HatRed Hat OpenStack Platform 18.0—

References

Timeline

Published
May 5, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-43872.0StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSCVE-2026-438707.3Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF SeqCVE-2026-438717.5Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects ACVE-2026-438725.3Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path traversal vulnerabiCVE-2026-438737.5WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CCVE-2026-438747.2WWBN AVideo is an open source video platform. In versions up to and including 29.0, the server-side mitigation for the YPTSocket autoEvalCodCVE-2026-438756.8WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/MobileManager/oauth2.php completes an OAuth loginCVE-2026-438766.4WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/notifySubscribers.json.php takes the raw messageCVE-2026-438775.4WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSavePhoto.php is a legacy profile-photo endpCVE-2026-438786.1WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/iframe.php echoes the attacker-controlled usCVE-2026-438795.4WWBN AVideo is an open source video platform. In versions up to and including 29.0, an authenticated user can configure their own donation-nCVE-2026-43887.2The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Matrix field (Text Box input type) in form
CVE-2026-43869: High severity, CVSS 7.3 | Vulnix