CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass
Found by web discovery while looking for coverage of CVE-2026-34486
Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.
CVE-2026-34486 is a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw; Apache rated it Important and NVD scores it 7.5 High. Decryption failures are now forwarded to an unfiltered ObjectInputStream, and public PoC repositories demonstrate unauthenticated RCE on default port 4000 when clustering, the EncryptInterceptor, a reachable receiver and deserialization gadgets are all present. Affected releases 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected.
- Reported by Bartlomiej Dmitruk of Striga; affects releases carrying the CVE-2026-29146 fix.
- Exploitation requires Tribes clustering, EncryptInterceptor, reachable port 4000 and gadget libraries.
- CVSS 7.5 vector understates risk since unauthenticated RCE is demonstrable in PoCs.
- The fail-open change moved super.messageReceived() out of the try block, keeping undecrypted messages.
- Products
- Apache Tomcat
- Organizations
- HeroDevs
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-34486+1 related CVE | EncryptInterceptor Bypass Exposes Cluster Traffic in Apache Tomcat | 7.5 | 99% | KEV | KEV |
From the original article
12 min read at herodevs.com
CVE-2026-34486 flips Tomcat's EncryptInterceptor fail-open, exposing port 4000 to unauthenticated RCE. Affected versions, root cause, and how to patch.
herodevs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.