Apache Tomcat CVE-2026-101296

Exploitation requires the target Tomcat instance to be configured with a JNDI realm (JNDIRealm) using a non-GSSAPI SASL authentication mechanism - this specific, non-default realm/SASL configuration is the mandatory precondition and is reflected by the CVSS 4.0 AT:P (Attack Requirements: Present) flag. When that condition is met, the attacker needs only network access to the authentication endpoint and a valid username; no valid password, prior authentication (PR:N), or user interaction (UI:N) is required. The principal LIMITING factor is the configuration dependency: Tomcat deployments using the default realms (e.g., MemoryRealm, DataSourceRealm/JDBC, or JNDI with GSSAPI SASL) are not affected, which substantially narrows the exploitable population despite the network-facing, unauthenticated nature of the flaw.

This is a genuine high-severity authentication bypass (CWE-304, Missing Critical Step in Authentication) confirmed by the Apache Software Foundation and tracked in NVD/EUVD. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 9.1 and indicates a network-reachable, low-complexity, unauthenticated attack with HIGH confidentiality and integrity impact - consistent with SSVC Technical Impact of 'total'. However, the signals are not uniformly alarming: SSVC reports Exploitation 'none' and Automatable 'no', there is no CISA KEV listing, and no public exploit code was provided in the intelligence set. The CVSS AT:P ('Attack Requirements: Present') flag is the key nuance and aligns with the description's precondition - the flaw only manifests when a JNDI realm is configured with a non-GSSAPI SASL authentication mechanism, which is a non-default, relatively uncommon deployment choice. So while raw CVSS (9.1) looks critical, the realistic blast radius is constrained to the subset of Tomcat instances using that specific realm/SASL configuration. No EPSS score was supplied, so widespread-exploitation probability cannot be independently quantified. Net: treat as a real priority for environments known to use JNDI realm SASL authentication (immediate patch), but lower urgency for the majority of Tomcat deployments that do not use this configuration.

An attacker reaches a Tomcat application whose JNDI realm is configured to use a non-GSSAPI SASL authentication mechanism and submits credentials for a valid username with an incorrect or empty password; because a critical authentication step is skipped, the server accepts the login and grants access as that user. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means a successful request requires no special timing or evasion once the vulnerable SASL configuration is present.