How to fix CVE-2026-29145?

Within 24 hours: Inventory all Tomcat 9.x-11.x deployments and identify instances using CLIENT_CERT authentication with soft-fail disabled. Verify current versions against affected range (Tomcat Native 1.1.23-2.0.13). Within 7 days: Implement network segmentation to restrict access to Tomcat ports; enable detailed audit logging for authentication events; consider temporarily switching to alternative authentication mechanisms if operationally feasible. Within 30 days: Monitor Apache security advisories for patch release; plan upgrade strategy to patched Tomcat version when available; conduct security assessment of accessed resources during exposure period.

Is Tomcat affected by CVE-2026-29145?

Apache Tomcat versions 9.x through 11.x contain a critical authentication bypass in CLIENT_CERT validation that allows unauthenticated attackers to access protected resources without valid credentials.

CVE-2026-29145

EUVD-2026-21011 CRITICAL

2026-04-09 apache

GHSA-95jq-rwvf-vjx4

9.1

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch Released

Apr 11, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 19:45 euvd

EUVD-2026-21011

Analysis Generated

Apr 09, 2026 - 19:45 vuln.today

CVE Published

Apr 09, 2026 - 19:20 nvd

CRITICAL 9.1

Description

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Analysis

Authentication bypass in Apache Tomcat 9.x through 11.x and Tomcat Native 1.1.23-2.0.13 allows unauthenticated remote attackers to bypass CLIENT_CERT authentication when soft-fail is disabled, achieving unauthorized access to confidentiality- and integrity-sensitive resources. Exploitation requires no user interaction or privileges (CVSS:3.1 PR:N/UI:N). …

Remediation

Within 24 hours: Inventory all Tomcat 9.x-11.x deployments and identify instances using CLIENT_CERT authentication with soft-fail disabled. Verify current versions against affected range (Tomcat Native 1.1.23-2.0.13). …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.0

CVSS: +46

POC: 0

CVE-2026-29145 vulnerability details – vuln.today

Back

CVE-2026-29145

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Analysis

Full analysis requires sign-in

Priority Score

Share

CVE-2026-29145

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Full analysis requires sign-in

Priority Score

Share

External POC / Exploit Code