CVE-2026-43869¶
WSO2 Products impacted: Limited
Customer action required: Yes - apply the latest product update
REPORTED VULNERABILITY¶
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift versions before 0.23.0 1. In the Java library, client-side TLS sockets created through TSSLTransportFactory.getClientSocket validate the server certificate chain against the configured truststore but do not verify that the certificate matches the hostname being connected to.
REPORTED PRODUCTS¶
- WSO2 Identity Server : 5.11.0, 6.0.0, 6.1.0, 7.0.0, 7.1.0, 7.2.0, 7.3.0
WSO2 JUSTIFICATION¶
WSO2 Identity Server bundles Apache Thrift 0.16.0 through a WSO2 OSGi orbit bundle (libthrift_0.16.0.wso2v1.jar), which is used by the WSO2 Carbon Data Bridge to publish analytics events to an external WSO2 analytics receiver. The vulnerable client-side code path is reachable only through this data-bridge agent. The agent opens a connection only when the first event is published, and all analytics event publishers are disabled in the default product configuration. Therefore, the vulnerability is not reachable in a default deployment. It becomes reachable only when analytics event publishing is explicitly enabled.
Upgrading directly to Apache Thrift 0.23.0 is not a straightforward option for all supported product versions because of the compatibility impact on the data-bridge components that depend on it. WSO2 has therefore ported the upstream fix to its maintained Thrift fork 2. The fix configures the client SSL socket with the HTTPS endpoint identification algorithm, so the server's hostname is verified against its certificate during the TLS handshake. The patched library is released as libthrift 0.16.0.wso2v3.
CONCLUSION¶
- In the default configuration of WSO2 Identity Server, the vulnerable Thrift client code path is not invoked.
- The fix has been ported to WSO2's Thrift fork and is available in WSO2 Identity Server latest update level.
Customers using analytics event publishing, or who wish to remove the vulnerable library version from their deployment, are advised to update WSO2 Identity Server 7.3.0 to update level 19 or later.