CVE-2026-66053

This CVE describes a certificate hostname validation bypass in Apache Thrift's Python binding that permits man-in-the-middle attacks. The flaw is straightforward: the Python ssl transport is configured without `check_hostname=True`, meaning certificate hostnames are never validated even when certificate chain validation is enabled. An attacker on the network path can present a valid certificate from any domain and the Thrift client will accept it, decrypting traffic in transit. The CVSS 5.9 score is worth questioning. Structurally, this is a network-level MITM with high confidentiality and integrity impact, which typically scores above 7.0. The likely limiting factor is that exploitation requires the attacker already be positioned on the network path between client and server — this is an attack-from-adjacent scenario, not arbitrary remote exploitation. The EPSS score of 0.00305 corroborates this: the community assesses low real-world exploitability, likely because the vulnerable configuration is non-default and because the attacker must already control network infrastructure. The replacement of CVE-2026-41603 with this CVE signals that the original disclosure was materially wrong — either the version range, the affected component, or the technical description was inaccurate. If you patched against the earlier CVE, re-audit whether your fix actually addresses hostname validation, not just certificate chain validation. The replacement pattern suggests the 0.24.0 fix either changed scope or corrected a mischaracterization. Python's ssl module is the culprit here, not Thrift specifically. The API requires both `verify_mode=CERT_REQUIRED` and `check_hostname=True` to enable full validation, and these are often configured independently. This is a known API trap that has produced similar flaws in other Python libraries. The Python-specific citation likely reflects what the original reporter tested, not necessarily a Python-only flaw — audit other language bindings if you use them, as they may share underlying transport logic. Actionable steps: verify your Thrift Python clients explicitly set `check_hostname=True` in their SSLContext; confirm the server certificate's Common Name or Subject Alternative Name matches the hostname you're connecting to; if you've already patched against CVE-2026-41603, validate that your fix actually enables hostname checking rather than just certificate validation.

Reviewed through automated stages and approved by a human before publication.