47
CVE-2026-34486: Apache Tomcat Auth Bypass Vulnerability
SentinelOne details CVE-2026-34486, an Apache Tomcat EncryptInterceptor bypass exposing unencrypted cluster communications, with patches and workarounds available.
CVE-2026-34486 stems from an incomplete fix for CVE-2026-29146, letting network-positioned attackers bypass the EncryptInterceptor and read plaintext Tomcat cluster traffic, including session and application data between nodes. Affected versions 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21. Workarounds include network-level encryption such as IPsec or VPN tunnels and isolating cluster communications to secured network segments.
45
60
47
47
CVE-2026-67593: Apache Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion
CVE-2026-67593: remote attackers can delete ActiveMQ Artemis queues via pre-authentication Openwire protocol handling in affected versions.
A remote attacker can exploit pre-authentication handling of the Openwire protocol to result in queue deletion on affected Apache Artemis and ActiveMQ Artemis brokers. Affected components include artemis-openwire-protocol and artemis-jakarta-openwire-protocol in Apache Artemis 2.50.0 through 2.56.0, and artemis-openwire-protocol 1.0.0 through 2.44.0 plus artemis-jakarta-openwire-protocol 2.32.0 through 2.44.0 in ActiveMQ Artemis. Apache rates the issue important.
45
CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing
Apache MyFaces fixes critical CVE-2026-76646, a remote denial-of-service flaw triggered by crafted request parameters across versions 2.2.0-4.1.3.
Apache MyFaces disclosed CVE-2026-76646, a critical denial-of-service vulnerability in which remote attackers can cause excessive resource consumption by supplying specially crafted request parameters. Affected versions span 2.2.0-2.2.15, 2.3.0-2.3.11, 3.0.0-3.0.3, 4.0.0-4.0.3, 4.1.0-4.1.3 and 2.3-next-*. The disclosure notes older versions may also be impacted.
45
47
47
CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables
Apache Doris authorization bypass CVE-2026-72524 lets authenticated low-privilege users read, write, or drop arbitrary tables in affected 3.1.x through 4.1.3 versions.
CVE-2026-72524 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated low-privilege user to bypass privilege checks and read, write, or drop arbitrary tables. Affected versions include Apache Doris 3.1.0 through 3.1.*, 4.0.0 through 4.0.7, and 4.1.0 through 4.1.3. The flaw permits access to or modification of data the user is not authorized to touch.
30
47
47
CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs
Apache Syncope patches an important Groovy sandbox escape (CVE-2026-77147) allowing administrators to achieve code injection via empty CommandArgs.
CVE-2026-77147 is an important-severity improper control of code generation vulnerability in Apache Syncope, rated as a Groovy sandbox escape for empty CommandArgs. An administrator with adequate privileges can exploit the flaw to achieve code injection. Affected versions include syncope-core-spring 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.
25
CVE-2026-73178: Apache Syncope: JWT Access Token takeover
Apache Syncope discloses CVE-2026-73178, an important-severity flaw enabling JWT access token takeover in versions 3.0.x through 4.1.2.
Apache Syncope disclosed CVE-2026-73178, an Exposure of Sensitive Information to an Unauthorized Actor vulnerability rated important that allows JWT access token takeover. Affected versions include syncope-core-provisioning-java 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to the latest fixed releases.
42
47
60
47
47
CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
CVE-2026-59739: Apache ZooKeeper missing ACL check in SetWatches reconnect replay lets attackers discover ACL-restricted znode paths.
Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 contain a critical information disclosure (CVE-2026-59739) caused by a missing ACL check during SetWatches reconnect replay. An attacker can register exists-watches on non-existent paths and reconnect after those paths are created, revealing the existence of ACL-restricted paths. The issue is fixed in patched releases.
45
CVE-2026-80352: Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
Apache Camel K CVE-2026-80352 lets CR authors inject arbitrary Kubernetes objects via Master trait serviceAccountName YAML injection.
Apache disclosed a critical YAML injection vulnerability (CVE-2026-80352, improper control of code generation) in Apache Camel K's Master trait serviceAccountName setting. An authorized custom resource author can inject arbitrary Kubernetes objects, potentially enabling unauthorized resource manipulation. Affected versions are 2.0.0 before 2.9.3 and 2.10.1 before 2.10.2; fixes are available in 2.9.3 and 2.10.2.
35
CVE-2026-41870: Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)
Apache fixed CVE-2026-41870, a critical unauthenticated RCE via JEXL injection in Nutch Server's REST API affecting versions 1.11-1.22.
CVE-2026-41870 describes a critical Missing Authorization and Code Injection vulnerability in Apache Nutch Server (the Nutch REST API), enabling unauthenticated remote code execution via JEXL injection. Affected versions are Apache Nutch 1.11 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server; users who cannot upgrade must apply mitigations.
55
47
CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles
Apache NiFi Registry 0.4.0-2.11.0 allows path manipulation when storing extension bundle content from uploaded NAR manifests (CVE-2026-87976, High).
Apache NiFi Registry versions 0.4.0 through 2.11.0 are affected by improper limitation of a pathname (CVE-2026-87976), rated High severity by the maintainers. When storing extension bundle content, the default file persistence provider used group, artifact, and version coordinates from uploaded NAR manifests as filesystem path components without sufficient validation. The disclosure was posted by Apache NiFi maintainer David Handermann on the oss-security mailing list.
42
CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
Apache NiFi CVE-2026-70469: duplicate or non-standard Content-Encoding headers bypass gzip request filtering in NiFi 2.11.0's REST API.
Apache NiFi disclosed CVE-2026-70469, rated High, affecting the Jetty-based REST API module (org.apache.nifi:nifi-jetty) in version 2.11.0. NiFi 2.11.0 disabled gzip-encoded HTTP requests and rejects those carrying the standard Content-Encoding header, but the framework enforcement filter fails to check multiple instances of the header and does not reject non-standard gzip identifiers, allowing crafted requests to evade the check. The disclosure was posted to oss-security by David Handermann.
45
CVE-2026-56207: Apache Impala: SAML authentication bypass via forged bearer token
Apache Impala CVE-2026-56207 allows forged SAML bearer tokens on the hs2-http interface, letting attackers impersonate other users; fixed in 4.5.2.
Apache Impala versions 4.0.0 through 4.5.1 fail to verify the bearer token signature in the final step of SAML2 authentication for the hs2-http interface. An attacker can alter the username and act as another user. Users are recommended to upgrade to version 4.5.2, and Apache rated the issue critical. It was reported by Andrew Rukin of Arenadata.
46
47
42
47
60
47
47
CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder
Unauthenticated remote memory exhaustion in Apache Storm Worker 3.0.x Netty decoder fixed in 3.1.0, allowing pre-auth denial of service.
CVE-2026-82435 (rated important) affects Apache Storm Worker (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0. The worker's Netty message decoder sits ahead of SASL authentication handlers and processes frames before any authentication occurs. It allocates buffers sized from an attacker-controlled length field, so a single frame from an unauthenticated peer reaching the worker can exhaust memory. Users must upgrade to 3.1.0.
45
CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant
Setuid-root Apache Storm worker-launcher chowns worker directory to the tenant before reading its command file, enabling local root privilege escalation.
CVE-2026-82430 affects Apache Storm Worker Launcher (org.apache.storm:storm-core) versions 3.0.0 before 3.1.0, rated important. When launching Docker or OCI workers, the setuid-root worker-launcher transfers ownership of the entire worker directory to the untrusted topology user before reading and acting on the supervisor-written command file in that directory. An untrusted tenant can tamper with the command file to achieve local privilege escalation to root. Fixed in version 3.1.0.
38
CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher
Apache Storm's setuid-root worker-launcher re-resolves paths during recursive chown/chmod, letting local users win a race to escalate to root.
CVE-2026-82429 affects Apache Storm Worker Launcher (org.apache.storm:storm-core) versions 3.0.0 before 3.1.0, rated important. The setuid-root worker-launcher walks worker directories with FTS calling lchown and chmod on full pathnames while running with effective uid 0, and both syscalls re-resolve the path at call time. A local attacker can exploit this time-of-check race by swapping path components to gain root privileges. Fixed in version 3.1.0.
36
47
42
47
47
60
CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
Critical ZooKeeper flaw lets any authenticated client delete arbitrary empty persistent or container znodes by bypassing ACL checks.
CVE-2026-79993 (critical severity) affects Apache ZooKeeper 3.9.0-3.9.5 and 3.8.0-3.8.6. The deleteContainer opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific empty znodes in the data tree regardless of ACL restrictions on the znode or its parent. This can corrupt coordination state for dependent distributed systems like Kafka, HBase, or Solr clusters relying on ZooKeeper.
50