EncryptInterceptor bypass in Apache Tomcat (CVE-2026-34486)

An error in the fix for CVE-2026-29146 allowed the EncryptInterceptor to be bypassed in Apache Tomcat, leaving sensitive data unencrypted in transit. This missing encryption of sensitive data poses a risk to deployments relying on the EncryptInterceptor for cluster communication security. ⚠️ Actively exploited in the wild (CISA KEV). Affected versions: - Apache Tomcat 11.0.20 - Apache Tomcat 10.1.53 - Apache Tomcat 9.0.116 We recommend updating to: Apache Tomcat 11.0.21, Apache Tomcat 10.1.54, Apache Tomcat 9.0.117. CVSS 9.8 · our assessment: act_now Reference: https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly Details: https://vuln.today/cve/CVE-2026-34486