CVE-2026-85087
MEDIUMCVSS 6.9/10
Last modified
CVE-2026-85087 is a medium-severity vulnerability rated 6.9/10 on the CVSS scale. Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue..
Description
Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Thrift | < 0.25.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-85087?
Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
How severe is CVE-2026-85087?
CVE-2026-85087 has a CVSS score of 6.9/10 (MEDIUM severity).
How do I fix CVE-2026-85087?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-85081The File Manager WordPress plugin before 8.0.5, FileOrganize…7.5
- CVE-2026-85082Root Browser Classic 3.3.0 passes the path of a selected SQL…8.5
- CVE-2026-85083The ANJIA AJL33PC0801 IP camera uses a hard-coded credential…6.8
- CVE-2026-85084Out-of-bounds Write and Improper Validation of Array Index v…6.3
- CVE-2026-85085The Canva Android App before 2.376.0 allowed an external ori…9.6
- CVE-2026-85086Improper certificate validation, Initialization of a resourc…6.9
- CVE-2026-85088Improper Validation of Certificate with Host Mismatch in the…6.9
- CVE-2026-85089FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transm…6.5
- CVE-2026-8509Heap buffer overflow in WebML in Google Chrome prior to 148.…8.8
- CVE-2026-85090FreeRDP before 3.31.0 contains a heap out-of-bounds read vul…5.4
- CVE-2026-85091zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer ov…7.4
- CVE-2026-85092LiME through 1.12.0 fails to validate the disk acquisition o…6.6
Are you affected by CVE-2026-85087?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST