CVE-2026-34486: Apache Tomcat Auth Bypass Vulnerability
Found by web discovery while looking for coverage of CVE-2026-34486
SentinelOne details CVE-2026-34486, an Apache Tomcat EncryptInterceptor bypass exposing unencrypted cluster communications, with patches and workarounds available.
CVE-2026-34486 stems from an incomplete fix for CVE-2026-29146, letting network-positioned attackers bypass the EncryptInterceptor and read plaintext Tomcat cluster traffic, including session and application data between nodes. Affected versions 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21. Workarounds include network-level encryption such as IPsec or VPN tunnels and isolating cluster communications to secured network segments.
- CWE-311 missing-encryption flaw exposes session and application data between cluster nodes.
- Immediate upgrades to fixed versions recommended; verify cluster encryption after patching.
- Attack requires network access between cluster nodes but no authentication.
- Network workarounds include IPsec/VPN tunneling and strict access controls on cluster ports.
- Products
- Apache Tomcat
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-34486+1 related CVE | EncryptInterceptor Bypass Exposes Cluster Traffic in Apache Tomcat | 7.5 | 99% | KEV | KEV |
From the original article
3 min read at sentinelone.com
CVE-2026-34486 is an authentication bypass flaw in Apache Tomcat caused by missing encryption of sensitive data, allowing attackers to bypass EncryptInterceptor. This article covers technical details, affected versions, and mitigation.
sentinelone.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.