CVE-2026-101296: A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was config

CVE-2026-101296: Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

Posted by Mark Thomas on Oct 20 Severity: important Affected versions: - Apache Tomcat 11.0.0-M1 through 11.0.26 - Apache Tomcat 10.1.0-M1 through 10.1.60 - Apache Tomcat 9.0.0.M1 through 9.0.122 - Apache Tomcat 8.5.0 through 8.5.100 - Apache Tomcat 7.0.0 through 7.0.109 Description: A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with…

oss-securityOct 20, 17:27 UTC · 2d agoVulnerability CVE-2026-1012963· 3 reads

October 21 Cybersecurity Nightmare: PHP and Node.js Flaws, LiteLLM Backdoor, and Active Attacks

October 21, 2026 brought a demanding mix of emergency security updates, poisoned software releases, and warnings about attacks already underway. PHP servers needed urgent patches. An AI software package was stealing credentials. Other investigations exposed weaknesses in certificate trust, remote management, and VPN access. Several incidents began before October 21, but their recovery work…

Cyber Security News07:16 UTC · 11h agoMalware in the wildCVE-2026-109618 CVE-2026-109619 CVE-2026-111497+2 CVEs2

Apache Tomcat Fixes 8 Security Flaws That Could Let Hackers Bypass Authentication

Apache Tomcat has fixed eight security flaws that could let attackers bypass password checks, expose data between users, and disrupt connections under specific conditions. Apache disclosed the vulnerabilities on October 20, 2026, after releasing fixes in Tomcat 11.0.27, 10.1.61, and 9.0.123. The eight issues span different release branches, so not every flaw affects every version. Apache rates…

Cyber Security NewsOct 21, 08:28 UTC · 1d agoVulnerability in the wildCVE-2026-101296 CVE-2026-101356 CVE-2026-103119+6 CVEs1

Apache Tomcat Security Flaws Allow Attackers to Bypass Authentication and Expose User Data

Apache disclosed eight vulnerabilities in Tomcat, including authentication bypass , cross-user data exposure, insecure socket access, and cryptographic configuration failures. Of these, three are rated Important, and five are rated Low. Fixes are available in Tomcat versions 11.0.27, 10.1.61, and 9.0.123, depending on the affected version branch. These vulnerabilities affect specific components…

GBHackersOct 21, 09:05 UTC · 1d agoVulnerability CVE-2026-101296 CVE-2026-103119 CVE-2026-101356+6 CVEs2· 1 read

CVE-2026-101296

In the news4 stories

CVE-2026-101296: Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms

October 21 Cybersecurity Nightmare: PHP and Node.js Flaws, LiteLLM Backdoor, and Active Attacks

Apache Tomcat Fixes 8 Security Flaws That Could Let Hackers Bypass Authentication

Apache Tomcat Security Flaws Allow Attackers to Bypass Authentication and Expose User Data