Apache Tomcat flaws allow auth bypass and data exposure
Eight issues span three branches; Important fixes are in Tomcat 11.0.27, 10.1.61 and 9.0.123, with no exploitation stated.
4
Stories per day · 30 days
2 RSS
Relatedhttp24ajp3authentication-bypass2incomplete-cleanup2jndirealm2apr1authentication1availability1buffer-under-read1fail-open1information-disclosure1information-leak1jndi1local-access1sasl1session-mixup1tls1toctou1
8 stories, newest first · one card per story
Stories tagged #apache-tomcat
Apache Tomcat patches eight flaws, including a password bypass
Fixes shipped in 11.0.27, 10.1.61 and 9.0.123; three issues are Important and no active exploitation is reported.
6
Tomcat HTTP/2 async flaw can mix users' requests (CVE-2026-101356)
Apache rates the issue important; the excerpt lists three affected version ranges and no fix.
Tomcat JNDIRealm auth fails open for non-GSSAPI SASL (CVE-2026-101296)
Apache rates the flaw important across Tomcat 7 through 11 ranges when JNDIRealm uses non-GSSAPI SASL.
Hackers Use AI Agents and GodPotato Exploit to Gain Windows SYSTEM Privileges
Attackers used AI agents and GodPotato to turn an exposed Tomcat endpoint into Windows SYSTEM access.
CVE-2026-34486: Apache Software Foundation Apache Tomcat
CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.
5
CVE-2026-34486: Apache Tomcat EncryptInterceptor Fail-Open Bypass
Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.
10
CVE-2026-34486: Apache Tomcat Auth Bypass Vulnerability
SentinelOne details CVE-2026-34486, an Apache Tomcat EncryptInterceptor bypass exposing unencrypted cluster communications, with patches and workarounds available.
4