Story · 1 source · 1 articlefirst Sep 8, 20:09 UTCupdated Sep 8, 20:09 UTC (8d ago)2

CVE-2026-34486: Actively Exploited Apache Tomcat EncryptInterceptor Fail-Open Bypass Enables Unauthenticated RCE; Added to CISA KEV

highExploit / PoCimportance 72CVE-2026-34486 CVE-2026-29146

What's new: First merged summary of this story. Report 1 provided the technical root-cause analysis (fail-open regression, affected and fixed versions, PoC-demonstrated RCE); Report 2 added the escalation signal that CISA listed CVE-2026-34486 in its KEV catalog on August 4, 2026 with active exploitation observed and BOD 26-04 remediation required.

Merged summary · glm-5.3 · rewritten as coverage arrives

A fail-open regression in Tomcat Tribes EncryptInterceptor (CVE-2026-34486), introduced by the fix for CVE-2026-29146, permits unauthenticated Java deserialization RCE on clustering port 4000 and was added to CISA's KEV catalog on August 4, 2026.

CVE-2026-34486 is a fail-open regression in Apache Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw in cluster encryption. The flawed code moved super.messageReceived() out of the try block, so decryption failures are now forwarded to an unfiltered ObjectInputStream, keeping undecrypted messages. Public PoC repositories demonstrate unauthenticated remote code execution via Java deserialization on the default Tribes receiver port 4000, provided clustering with EncryptInterceptor, a reachable receiver, and deserialization gadget libraries are all present. Apache rated the flaw Important and NVD scores it 7.5 High, though the vector arguably understates the demonstrated unauthenticated RCE. Affected releases are 9.0.116, 10.1.53 and 11.0.20, fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected. CISA added the vulnerability to its Known Exploited Vulnerability catalog on August 4, 2026, citing actively observed exploitation and requiring remediation under BOD 26-04 guidance, alongside actively exploited Langflow and N-central flaws. Official patches and workarounds are available.

CVE-2026-34486 is a fail-open regression in Tomcat Tribes EncryptInterceptor introduced by the fix for the CVE-2026-29146 padding-oracle flaw.
Decryption failures are forwarded to an unfiltered ObjectInputStream because super.messageReceived() was moved out of the try block, allowing unauthenticated RCE via Java deserialization.
Exploitation requires Tribes clustering, EncryptInterceptor, a reachable receiver on default port 4000, and deserialization gadget libraries; public PoCs demonstrate unauthenticated RCE.
Affected releases: 9.0.116, 10.1.53, 11.0.20; fixed in 9.0.117, 10.1.54, 11.0.21; Tomcat 8.5 is unaffected.
Apache rated the issue Important; NVD scores it CVSS 7.5 High, which reporting notes understates the demonstrated unauthenticated RCE risk.
Reported by Bartlomiej Dmitruk of Striga.
CISA added CVE-2026-34486 to the KEV catalog on August 4, 2026; exploitation is actively observed and remediation is required under BOD 26-04 guidance.
The KEV addition was made alongside actively exploited Langflow and N-central vulnerabilities.

VendorsApache Software Foundation Striga

ProductsApache Tomcat Langflow N-central

OrganizationsCISA HeroDevs

Coverage timelineoldest first · each row is one article

Sep 8, 20:09 UTC · 8d ago
Web discovery (articles for new exploits & KEV entries)· 65
CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass
Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-34486 +1 in the same advisory: …29146	EncryptInterceptor Bypass Exposes Cluster Traffic in Apache Tomcat CVE-2026-34486 is a missing-encryption vulnerability in Apache Tomcat in which the EncryptInterceptor, the component that encrypts Tomcat cluster communication, can be bypassed in a fail-open manner; the flaw was introduced as a regression by the fix for CVE-2026-29146. It affects Tomcat 11.0.20, 10.1.53 and 9.0.116, and is triggered when cluster communication is expected to be encrypted: an attacker positioned on the network path between cluster nodes receives inter-node traffic in cleartext. By reading that unencrypted traffic, the attacker can obtain sensitive data such as session payloads, potentially enabling session theft and authentication bypass as indicated by related reporting. Only deployments running the affected point releases with the EncryptInterceptor in use are impacted, including Tomcat shipped in Red Hat JBoss Web Server and Red Hat Enterprise Linux channels. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-04, EPSS places 30-day exploitation probability at 98.6%, though no public proof-of-concept is known and ransomware use is unconfirmed. Do: Upgrade Apache Tomcat to 11.0.21, 10.1.54 or 9.0.117, and apply the corresponding Red Hat JBoss Web Server / Enterprise Linux updates when published. Audit Tomcat cluster configurations for EncryptInterceptor usage, and until patched restrict or encrypt the network segment carrying inter-node cluster traffic. Because the flaw is in CISA's KEV catalog, federal agencies must patch per BOD 26-04 timelines and should review cluster nodes for signs of session data interception.	7.5	99%	KEV	Apache Tomcat 11.0.20, 10.1.53, 9.0.116 (fixed in 11.0.21, 10.1.54, 9.0.117) Red Hat JBoss Web Server (ships affected Tomcat) Red Hat Enterprise Linux (including ELS, EUS, TUS, and Update Services for SAP Solutions)	largetens of thousands of Tomcat deployments on the affected point releases	Apr 9, 2026

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-34486

+1 in the same advisory: …29146

EncryptInterceptor Bypass Exposes Cluster Traffic in Apache Tomcat

CVE-2026-34486 is a missing-encryption vulnerability in Apache Tomcat in which the EncryptInterceptor, the component that encrypts Tomcat cluster communication, can be bypassed in a fail-open manner; the flaw was introduced as a regression by the fix for CVE-2026-29146. It affects Tomcat 11.0.20, 10.1.53 and 9.0.116, and is triggered when cluster communication is expected to be encrypted: an attacker positioned on the network path between cluster nodes receives inter-node traffic in cleartext. By reading that unencrypted traffic, the attacker can obtain sensitive data such as session payloads, potentially enabling session theft and authentication bypass as indicated by related reporting. Only deployments running the affected point releases with the EncryptInterceptor in use are impacted, including Tomcat shipped in Red Hat JBoss Web Server and Red Hat Enterprise Linux channels. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-04, EPSS places 30-day exploitation probability at 98.6%, though no public proof-of-concept is known and ransomware use is unconfirmed.

Do: Upgrade Apache Tomcat to 11.0.21, 10.1.54 or 9.0.117, and apply the corresponding Red Hat JBoss Web Server / Enterprise Linux updates when published. Audit Tomcat cluster configurations for EncryptInterceptor usage, and until patched restrict or encrypt the network segment carrying inter-node cluster traffic. Because the flaw is in CISA's KEV catalog, federal agencies must patch per BOD 26-04 timelines and should review cluster nodes for signs of session data interception.

7.5

99%

KEV

Apache Tomcat 11.0.20, 10.1.53, 9.0.116 (fixed in 11.0.21, 10.1.54, 9.0.117)
Red Hat JBoss Web Server (ships affected Tomcat)
Red Hat Enterprise Linux (including ELS, EUS, TUS, and Update Services for SAP Solutions)

largetens of thousands of Tomcat deployments on the affected point releases

Apr 9, 2026