CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass Enables Plaintext Exposure and Unauthenticated RCE; Added to CISA KEV
CVE-2026-34486 is a fail-open regression in Apache Tomcat's Tribes EncryptInterceptor, introduced by the incomplete fix for the CVE-2026-29146 padding-oracle flaw, that exposes unencrypted cluster traffic and enables unauthenticated remote code execution via…
CVE-2026-34486 stems from a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw in cluster encryption. The one-line change moved super.messageReceived() out of the try block, so decryption failures are forwarded to an unfiltered ObjectInputStream while messages remain undecrypted. Per SentinelOne's coverage (CWE-311, missing encryption), network-positioned attackers can bypass the EncryptInterceptor and read plaintext Tomcat cluster traffic, including session and application data between nodes; technical analysis reported by Bartlomiej Dmitruk of Striga shows this also enables unauthenticated RCE via Java deserialization when Tribes clustering, the EncryptInterceptor, a reachable receiver (default port 4000) and deserialization gadget libraries are all present. Public PoC repositories demonstrate the RCE. Apache rated the flaw Important and NVD scores it CVSS 7.5 High, though the analysis argues the vector understates the risk. Affected versions 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21. CISA added the vulnerability to the Known Exploited Vulnerability catalog on August 4, 2026, noting active exploitation and requiring remediation under BOD 26-04, alongside actively exploited Langflow and N-central flaws. Workarounds include network-level encryption such as IPsec or VPN tunnels and isolating cluster communications to secured network segments with strict access controls on cluster ports.
- CVE-2026-34486 is a fail-open regression in Tomcat Tribes EncryptInterceptor, caused by an incomplete fix for the CVE-2026-29146 padding-oracle flaw; CWE-311 (missing encryption) applies.
- The fail-open change moved super.messageReceived() out of the try block, so decryption failures are forwarded to an unfiltered ObjectInputStream while messages remain undecrypted.
- Impact includes plaintext exposure of session and application data between cluster nodes (no authentication required) and unauthenticated RCE via Java deserialization on Tribes receiver port 4000.
- RCE exploitation requires Tribes clustering, the EncryptInterceptor, a reachable receiver on port 4000, and deserialization gadget libraries; public PoC repositories demonstrate it.
- Affected versions: 9.0.116, 10.1.53 and 11.0.20. Fixed versions: 9.0.117, 10.1.54 and 11.0.21. Tomcat 8.5 is unaffected.
- Apache rated the issue Important; NVD scores it CVSS 7.5 High, which the technical analysis argues understates the risk given demonstrable unauthenticated RCE.
- CISA added CVE-2026-34486 to the KEV catalog on August 4, 2026, with exploitation actively observed; remediation is required under BOD 26-04 guidance.
- Workarounds: network-level encryption via IPsec or VPN tunnels, and isolating cluster communications to secured network segments with strict access controls on cluster ports.
Coverage timelineoldest first · each row is one article
- · 7d agoCVE-2026-34486: Apache Tomcat Auth Bypass Vulnerability
Web discovery (articles for new exploits & KEV entries)· 45
SentinelOne details CVE-2026-34486, an Apache Tomcat EncryptInterceptor bypass exposing unencrypted cluster communications, with patches and workarounds available.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-34486 +1 in the same advisory: …29146 | EncryptInterceptor Bypass Exposes Cluster Traffic in Apache Tomcat CVE-2026-34486 is a missing-encryption vulnerability in Apache Tomcat in which the EncryptInterceptor, the component that encrypts Tomcat cluster communication, can be bypassed in a fail-open manner; the flaw was introduced as a regression by the fix for CVE-2026-29146. It affects Tomcat 11.0.20, 10.1.53 and 9.0.116, and is triggered when cluster communication is expected to be encrypted: an attacker positioned on the network path between cluster nodes receives inter-node traffic in cleartext. By reading that unencrypted traffic, the attacker can obtain sensitive data such as session payloads, potentially enabling session theft and authentication bypass as indicated by related reporting. Only deployments running the affected point releases with the EncryptInterceptor in use are impacted, including Tomcat shipped in Red Hat JBoss Web Server and Red Hat Enterprise Linux channels. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-04, EPSS places 30-day exploitation probability at 98.6%, though no public proof-of-concept is known and ransomware use is unconfirmed. Do: Upgrade Apache Tomcat to 11.0.21, 10.1.54 or 9.0.117, and apply the corresponding Red Hat JBoss Web Server / Enterprise Linux updates when published. Audit Tomcat cluster configurations for EncryptInterceptor usage, and until patched restrict or encrypt the network segment carrying inter-node cluster traffic. Because the flaw is in CISA's KEV catalog, federal agencies must patch per BOD 26-04 timelines and should review cluster nodes for signs of session data interception. | 7.5 | 99% | KEV |
| largetens of thousands of Tomcat deployments on the affected point releases |