What is the CVSS score of CVE-2026-29145?

CVE-2026-29145 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Tomcat are affected by CVE-2026-29145?

Apache Tomcat versions 9.x through 11.x contain a critical authentication bypass in CLIENT_CERT validation that allows unauthenticated attackers to access protected resources without valid…. A patch is available.

How to fix or mitigate CVE-2026-29145?

Within 24 hours: Inventory all Tomcat 9.x-11.x deployments and identify instances using CLIENT_CERT authentication with soft-fail disabled. Verify current versions against affected range (Tomcat Native 1.1.23-2.0.13). Within 7 days: Implement network segmentation to restrict access to Tomcat ports; enable detailed audit logging for authentication events; consider temporarily switching to alternative authentication mechanisms if operationally feasible. Within 30 days: Monitor Apache security advisories for patch release; plan upgrade strategy to patched Tomcat version when available; conduct security assessment of accessed resources during exposure period.

Tomcat CVE-2026-29145

EUVD-2026-21011 CRITICAL

Improper Authentication (CWE-287)

2026-04-09 apache

GHSA-95jq-rwvf-vjx4

Authentication Bypass Apache Red Hat Tomcat Suse

9.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 11, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 19:45 euvd

EUVD-2026-21011

Analysis Generated

Apr 09, 2026 - 19:45 vuln.today

CVE Published

Apr 09, 2026 - 19:20 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1,979 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (52 direct, 1,928 indirect)
1 maven packages depend on org.apache.tomcat:tomcat (1 direct, 0 indirect)
11 maven packages depend on org.apache.tomcat:tomcat-catalina (9 direct, 2 indirect)

Ecosystem-wide dependent count for version 9.0.83 and other introduced versions.

DescriptionNVD

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

AnalysisAI

Authentication bypass in Apache Tomcat 9.x through 11.x and Tomcat Native 1.1.23-2.0.13 allows unauthenticated remote attackers to bypass CLIENT_CERT authentication when soft-fail is disabled, achieving unauthorized access to confidentiality- and integrity-sensitive resources. Exploitation requires no user interaction or privileges (CVSS:3.1 PR:N/UI:N). …

RemediationAI

Within 24 hours: Inventory all Tomcat 9.x-11.x deployments and identify instances using CLIENT_CERT authentication with soft-fail disabled. Verify current versions against affected range (Tomcat Native 1.1.23-2.0.13). …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory