{"vulnerability": "CVE-2026-4387", "sightings": [{"uuid": "22e2c83e-81d9-47c8-9b39-e95fc24a8257", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43870", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml2xfsewtz22", "content": "CVE-2026-43870: Apache Thrift: Node.js web_server.js multi-vulnerability", "creation_timestamp": "2026-05-05T00:43:56.005539Z"}, {"uuid": "85eccb8e-bae7-4463-9cbe-e086e696b1a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43870", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml3zb4z75s2t", "content": "CVE-2026-43870 - Apache Thrift: Node.js web_server.js multi-vulnerability\nCVE ID : CVE-2026-43870\n \n Published : May 5, 2026, 7:45 a.m. | 50\u00a0minutes ago\n \n Description : Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Im...", "creation_timestamp": "2026-05-05T10:49:46.471434Z"}, {"uuid": "608610c2-0d92-4507-a8cf-657b8e09135c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43873", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mln34ysrfi2t", "content": "\ud83d\udfe0 CVE-2026-43873 - High (7.5)\n\nWWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneS...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-43873/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-12T05:38:38.424613Z"}, {"uuid": "f3c3b5a2-aca8-41b1-80d3-29f477497520", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43873", "type": "published-proof-of-concept", "source": "https://github.com/WWBN/AVideo/security/advisories/GHSA-qm9p-p5pw-jrx2", "content": "", "creation_timestamp": "2026-04-25T00:46:54.000000Z"}, {"uuid": "d4bb2ae8-24e4-4358-a885-ce8e3c8c74c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43874", "type": "published-proof-of-concept", "source": "https://github.com/WWBN/AVideo/security/advisories/GHSA-ghcv-22jf-vfxm", "content": "", "creation_timestamp": "2026-04-25T00:50:46.000000Z"}, {"uuid": "d4f4038b-59dc-4177-9189-37afe3976594", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43879", "type": "published-proof-of-concept", "source": "https://github.com/WWBN/AVideo/security/advisories/GHSA-wp38-whx3-xffh", "content": "", "creation_timestamp": "2026-04-27T14:39:23.000000Z"}, {"uuid": "4e590f7d-5fab-4e6c-a520-cf92a929af23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43875", "type": "published-proof-of-concept", "source": "https://github.com/WWBN/AVideo/security/advisories/GHSA-5w8w-26ch-v5cw", "content": "", "creation_timestamp": "2026-04-25T00:54:22.000000Z"}, {"uuid": "2088a3f2-38c3-4627-b6c4-847fc7be827f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43877", "type": "published-proof-of-concept", "source": "https://github.com/WWBN/AVideo/security/advisories/GHSA-jw8g-5j46-44rp", "content": "", "creation_timestamp": "2026-04-25T01:06:24.000000Z"}, {"uuid": "9a473f4f-db83-48cc-bb69-c295ed13057d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43878", "type": "published-proof-of-concept", "source": "https://github.com/WWBN/AVideo/security/advisories/GHSA-mm5f-8q57-4fc4", "content": "", "creation_timestamp": "2026-04-25T01:13:27.000000Z"}, {"uuid": "fa4a3670-aafc-4422-b168-77f9f0b006d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-43876", "type": "published-proof-of-concept", "source": "https://github.com/WWBN/AVideo/security/advisories/GHSA-g9cm-rxp7-6gv5", "content": "", "creation_timestamp": "2026-04-25T00:57:12.000000Z"}, {"uuid": "c260563e-2b18-4668-b09d-e7b831dcb3ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4387", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmzkxilymg25", "content": "CVE-2026-4387 - Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file\nCVE ID : CVE-2026-4387\n \n Published : May 29, 2026, 8:16 p.m. | 15\u00a0minutes ago\n \n Description : StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0)...", "creation_timestamp": "2026-05-29T22:18:54.796451Z"}, {"uuid": "a71228f7-7ba5-4f99-bee4-1084766ba233", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4387", "type": "seen", "source": "https://bsky.app/profile/1cemoon.bsky.social/post/3mnakxoqqss2v", "content": "I'm excited to be able to finally publish the public disclosure for CVE-2026-4387. Check out my blog on discovering the reuse of the state.kv file to get authenticated sessions with StrongDM (now fixed). specterops.io/blog/2026/06...", "creation_timestamp": "2026-06-01T17:07:54.263971Z"}, {"uuid": "6d8c1423-26fe-4a92-85d4-3df9f66d7d66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4387", "type": "seen", "source": "https://bsky.app/profile/specterops.io/post/3mnan66epoz24", "content": "During an assessment, our team discovered that StrongDM auth state files containing JWTs & key material could be reused across hosts to obtain authenticated sessions & access infrastructure resources (CVE-2026-4387).\n\nRead more from @1cemoon.bsky.social: https://ghst.ly/4egbgVd", "creation_timestamp": "2026-06-01T17:48:52.675358Z"}, {"uuid": "2b7a22c0-06d2-4b51-983d-0a76ece5871c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43871", "type": "seen", "source": "https://gist.github.com/prajnak/06b8b2c74ce416478b826c460d0061f8", "content": "# Apache Thrift 2026 CVEs are invisible to purl-matching SCA\n\n**TL;DR** \u2014 The August 2026 Apache Thrift advisories (fixed in `0.24.0`) carry\n**CPE identifiers only**. No `pkg:pypi` / `pkg:maven` purl is ever produced, so any\nSCA that matches code libraries by ecosystem+purl finds nothing to attach them to.\nAn image with `thrift==0.22.0` installed from PyPI scans **clean**.\n\nThis is reproducible in two `curl` calls against public APIs \u2014 no scanner licence,\nno private data.\n\n---\n\n## Reproduce in 30 seconds (no Docker needed)\n\n### 1. Ask OSV whether PyPI `thrift` 0.22.0 has known vulnerabilities\n\n```bash\ncurl -s -X POST https://api.osv.dev/v1/query \\\n  -d '{\"package\":{\"name\":\"thrift\",\"ecosystem\":\"PyPI\"},\"version\":\"0.22.0\"}'\n```\n\n```json\n{}\n```\n\nEmpty. Zero vulnerabilities.\n\n### 2. Now confirm the advisory exists \u2014 and explicitly names Python\n\n```bash\ncurl -s https://api.osv.dev/v1/vulns/CVE-2026-41608 | jq '{id, summary}'\n```\n\n```json\n{\n  \"id\": \"CVE-2026-41608\",\n  \"summary\": \"Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport\"\n}\n```\n\nThe advisory exists. Its own summary says **Python**. `0.22.0` is in range\n(fixed in `0.24.0`). Yet step 1 returns nothing.\n\n---\n\n## Root cause\n\n```bash\ncurl -s https://api.osv.dev/v1/vulns/CVE-2026-41608 | jq '.affected[0]'\n```\n\n```json\n{\n  \"ranges\": [\n    {\n      \"type\": \"GIT\",\n      \"repo\": \"https://github.com/apache/thrift\",\n      \"events\": [\n        { \"introduced\": \"0\" },\n        { \"fixed\": \"6d2ec95f450b4ce404afb8929ff479e68770141a\" }\n      ],\n      \"database_specific\": {\n        \"cpe\": \"cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*\",\n        \"extracted_events\": [\n          { \"introduced\": \"0\" },\n          { \"fixed\": \"0.24.0\" }\n        ],\n        \"source\": \"CPE_RANGE\"\n      }\n    }\n  ],\n  \"versions\": [\"last-before-0-10\"]\n}\n```\n\nThree things to notice:\n\n1. **There is no `package` key.** No ecosystem, no name, no purl. A purl-matching\n   engine has nothing to key on.\n2. `ranges[0].type` is **`GIT`**, not `ECOSYSTEM` \u2014 the range is a commit SHA,\n   auto-derived from a CPE (`\"source\": \"CPE_RANGE\"`).\n3. `versions` is `[\"last-before-0-10\"]` \u2014 a placeholder artifact of that\n   conversion, not a usable version list.\n\nThe upstream advisory was filed against the Apache Thrift *product* via CPE.\nNothing downstream ever binds it to `pkg:pypi/thrift`, `pkg:maven/org.apache.thrift/libthrift`,\n`pkg:npm/thrift`, or any other ecosystem package.\n\n---\n\n## Reproduce against a container image\n\n```dockerfile\n# Dockerfile\nFROM python:3.12-slim\nRUN pip install --no-cache-dir thrift==0.22.0\n```\n\n```bash\ndocker build -t thrift-cve-repro:0.22.0 .\n```\n\nConfirm the package and its metadata are present and discoverable:\n\n```bash\ndocker run --rm thrift-cve-repro:0.22.0 \\\n  sh -c 'pip show thrift | head -2; ls /usr/local/lib/python3.12/site-packages | grep -i thrift'\n```\n\n```\nName: thrift\nVersion: 0.22.0\nthrift\nthrift-0.22.0.dist-info\n```\n\nNow scan that image with any purl-matching SCA.\n\n**Expected:** at least CVE-2026-41608, CVE-2026-48586, CVE-2026-43871 reported,\nfixed in `0.24.0`.\n\n**Actual:** zero findings for `thrift`. The SBOM correctly lists\n`thrift 0.22.0 (PyPI)` \u2014 discovery works fine. Only *matching* fails.\n\n---\n\n## Which advisories actually apply to a Python deployment\n\nApache Thrift published 18 advisories fixed in `0.24.0`. **Only three name the\nPython bindings.** These are the ones a PyPI `thrift` install is exposed to:\n\n| CVE | Bindings named in the advisory | CVSS |\n|---|---|---|\n| CVE-2026-41608 | **Python** only | 7.5 |\n| CVE-2026-48586 | C++, Java, **Python**, Go, D, C/GLib | 7.5 |\n| CVE-2026-43871 | **Python**, Go, PHP, Java | 7.5 |\n\nAll three: `AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H` \u2014 remote unauthenticated\ndenial of service against anything deserializing untrusted Thrift payloads.\n\nThe other 15 do **not** apply to a Python deployment. They are C++, c_glib,\nSwift, Rust, Node.js, Go and Java binding bugs \u2014 `TSSLSocket::matchName`,\n`web_server.js`, `TFramedTransport` uint32 overflow, and similar. None of that\ncode ships in the PyPI package.\n\nVerify any of them yourself:\n\n```bash\nfor c in CVE-2026-55971 CVE-2026-58023 CVE-2026-41604 CVE-2026-41602; do\n  curl -s \"https://api.osv.dev/v1/vulns/$c\" | jq -r '\"\\(.id)  \\(.summary)\"'\ndone\n```\n\n```\nCVE-2026-55971  Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()\nCVE-2026-58023  Apache Thrift: c_glib heap out-of-bounds read in transport\nCVE-2026-41604  Apache Thrift: Swift Range crash in skip()\nCVE-2026-41602  Apache Thrift: Go TFramedTransport uint32 overflow\n```\n\n---\n\n## What a fix should look like\n\nAdd ecosystem/purl mappings **per binding**, driven by the bindings each advisory\nnames in its own text:\n\n```\nCVE-2026-41608  ->  pkg:pypi/thrift                         (< 0.24.0)\nCVE-2026-48586  ->  pkg:pypi/thrift, pkg:maven/org.apache.thrift/libthrift, ...\nCVE-2026-43871  ->  pkg:pypi/thrift, pkg:maven/..., pkg:composer/...\n```\n\n## What a fix should **not** look like\n\nDo not blanket-CPE-match ecosystem packages against `cpe:2.3:a:apache:thrift`.\n\nA scanner that does this reports **all 18** against `thrift 0.22.0`, including\n~14 rated Critical \u2014 because it inherits per-binding CVSS scores from bindings\nthat aren't installed. That is roughly **5\u00d7 over-reported** for a Python\ndeployment, and triaging it back down to the real three costs more time than the\noriginal finding saved.\n\nThe gap here is precision *and* recall: three real findings are missed, and the\nnaive fix would introduce fifteen false ones.\n\n---\n\n## Wider question\n\nApache Thrift is unlikely to be unique. The pattern is: **one upstream project,\nmany language bindings, advisories filed at product level with CPE only**.\nOther multi-binding projects (protobuf, gRPC, Avro, Arrow, ICU, libxml2\nwrappers) plausibly share it.\n\nTwo things that would help anyone consuming this data:\n\n1. A way to report on SBOM components whose only matching advisories are\n   CPE-only \u2014 i.e. *where am I blind right now?*\n2. Systematic per-binding purl mapping where an advisory's text names the\n   affected bindings, rather than case-by-case backfill.\n\n---\n\n*Verified 2026-08-27 against `api.osv.dev`. Everything above uses public APIs and\npublic package data; no scanner output or private environment data is included.*\n", "creation_timestamp": "2026-08-27T11:48:03.261296Z"}, {"uuid": "44d767eb-7dcf-416c-becb-d65bc8bfe4f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43871", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mrghvod3i224", "content": "CVE-2026-43871: Apache Thrift: TCompactProtocol varint byte-count limit", "creation_timestamp": "2026-07-24T23:09:35.274753Z"}, {"uuid": "046fd9d7-e4a2-4025-b53d-2ed004582d0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-43871", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrqrz55jbh2s", "content": "\ud83d\udccc CVE-2026-43871 - Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thri... https://www.cyberhub.blog/cves/CVE-2026-43871", "creation_timestamp": "2026-07-29T01:37:13.815570Z"}]}