The flaw occurs in Apache Thrift’s TSSLTransportFactory, where certificate hostname verification is performed incorrectly. An attacker who can present a certificate that does not match the intended server hostname will be accepted by the client, permitting a man‑in‑the‑middle attack. This enables an adversary to intercept, read, or modify data transmitted over the Thrift connection and potentially inject malicious payloads if the data flows are unencrypted.

Apache Thrift, part of the Apache Software Foundation, is affected in all releases prior to version 0.23.0.

The CVSS score is 7.4 and the EPSS score is <1%, but because the exploitation requires only SSL/TLS interception, the likelihood of a successful MITM attack is significant in environments where Thrift services are publicly reachable. The vulnerability is not currently listed in the CISA KEV catalog, yet the absence of EKV does not diminish the risk posed by casual or sophisticated adversaries attempting to spy on or tamper with Thrift traffic.