Skip to main content

Apache Tomcat CVE-2026-29145

| EUVDEUVD-2026-21011 CRITICAL
Improper Authentication (CWE-287)
2026-04-09 apache GHSA-95jq-rwvf-vjx4
Authentication Bypass Apache Red Hat Tomcat Suse Apache Tomcat Apache Tomcat Native Apache Software Foundation
Critical
Disputed · 9.1 NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send HTTPS request with invalid client certificate
  2. Exploit
    CLIENT_CERT authentication bypassed due to soft fail disabled
  3. Impact
    Gain unauthorized access to protected resources

Vulnerability Assessment

Weakness
CWE
CWE-287
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK

2 techniques across 2 tactics: Defense Evasion, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires Apache Tomcat 9.0.83-9.0.115, 10.1.0-M7-10.1.52, or 11.0.0-M1-11.0.18 with CLIENT_CERT authentication enabled and soft fail disabled. Remote unauthenticated attacker can exploit default configurations.
Impact

CVSS 9.1 with unauthenticated network access reflects critical severity for client certificate bypass enabling unauthorized access. EPSS 0.04% indicates low observed exploitation activity despite broad impact across Tomcat versions. Priority depends on CLIENT_CERT reliance; organizations using certificate-based authentication for high-value services face elevated risk regardless of current exploit prevalence.
Exploit ScenarioDerived

Attacker sends unauthenticated network request to Tomcat instance with CLIENT_CERT authentication enabled but soft fail disabled. Authentication validation fails to reject the request properly, granting unauthorized access to protected resources. No public exploit code identified at time of analysis.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 09, 2026

Authentication bypass in Apache Tomcat 9.x through 11.x and Tomcat Native 1.1.23-2.0.13 allows unauthenticated remote attackers to bypass CLIENT_CERT authentication when soft-fail is disabled, achieving unauthorized access to confidentiality- and integrity-sensitive resources. Exploitation requires no user interaction or privileges (CVSS:3.1 PR:N/UI:N). The flaw affects CLIENT_CERT authentication logic, permitting access under conditions where authentication should fail. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.04%).

RemediationAI

Vendor-released patches: upgrade to Apache Tomcat 11.0.20, 10.1.53, or 9.0.116; upgrade Tomcat Native to 1.3.7 or 2.0.14. These versions resolve the CLIENT_CERT authentication bypass per official Apache advisory. Organizations using CLIENT_CERT authentication must prioritize upgrades given CVSS 9.1 critical severity and unauthenticated network attack vector. If immediate patching is infeasible, disable CLIENT_CERT authentication and migrate to alternative authentication mechanisms until upgrades complete. Verify authentication enforcement post-patch via functional testing of certificate-based access controls. Official advisory: https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz. Additional context: https://nvd.nist.gov/vuln/detail/CVE-2026-29145.

Affected VersionsENISA

Apache Tomcat Native 1.3.0 ≤1.3.6
Apache Tomcat Native 1.1.23 ≤1.1.34
Apache Tomcat 11.0.0-M1 ≤11.0.18
Apache Tomcat 10.1.0-M7 ≤10.1.52
Apache Tomcat 9.0.83 ≤9.0.115
Apache Tomcat Native 1.2.0 ≤1.2.39
Apache Tomcat Native 2.0.0 ≤2.0.13

Affected Packages

maven org.apache.tomcat.embed:tomcat-embed-core fix: 9.0.116, 10.1.53, 11.0.20
maven org.apache.tomcat:tomcat fix: 9.0.116, 10.1.53, 11.0.20
maven org.apache.tomcat:tomcat-catalina fix: 9.0.116, 10.1.53, 11.0.20
maven org.apache.tomcat:tomcat-coyote-ffm fix: 9.0.116, 10.1.53, 11.0.20
euvd apache_tomcat no fix
euvd apache_tomcat_native no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 6 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

CWE-287 improper authentication allows CLIENT_CERT authentication to succeed incorrectly when soft-fail mode is disabled. The vulnerability exists in native SSL/TLS certificate verification routines shared across Tomcat servlet containers and Native connectors, impacting both Java-based Tomcat servers and the APR/native integration layer.

Know when Apache Tomcat gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
SUSE CRITICAL
Red Hat 5.9 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
Patch released
Apr 11, 2026 - 02:30 nvd
Patch available
CVE Published
Apr 09, 2026 - 19:20 nvd
CRITICAL 9.1

DescriptionCVE.org

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Executive ViewAI

Why It Matters

Apache Tomcat versions 9.x through 11.x contain a critical authentication bypass in CLIENT_CERT validation that allows unauthenticated attackers to access protected resources without valid credentials. Organizations running affected Tomcat instances with certificate-based authentication are at immediate risk of unauthorized access to sensitive data and system compromise, with no vendor patch currently available.

Business Impact: Severe
Compensating Controls

Pending vendor patch availability. Interim mitigations: (1) Disable CLIENT_CERT authentication and migrate to alternative authentication (LDAP, SAML, OAuth); (2) Implement reverse proxy with re-authentication in front of Tomcat; (3) Restrict network access via firewall rules to trusted networks only; (4) Enable comprehensive authentication/access audit logging for post-incident analysis; (5) Monitor for anomalous authentication patterns and unauthorized resource access.

Threat Intelligence Overview

EPSS Score
0.0%
Top 89% exploitable
Threat Intel
1
1 source
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Partial

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Apache Tomcat

View all
CVE-2026-34486 HIGH POC
7.5 Apr 09

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi
CVE-2026-29146 HIGH POC
7.5 Apr 09

Padding oracle attack in Apache Tomcat EncryptInterceptor leaks encrypted session data confidentiality across versions 7
CVE-2026-50229 MEDIUM POC
6.1 Jun 29

Reflected XSS in Apache Tomcat's bundled 'number guess' example application exposes users of that demo page to script in
CVE-2026-76183 CRITICAL
9.8 Sep 23

Authentication bypass in Apache Tomcat allows unauthenticated remote attackers to reach WebSocket endpoints that are sup
CVE-2026-43512 CRITICAL
9.8 May 12

Authentication bypass in Apache Tomcat's DIGEST authentication implementation allows remote attackers to circumvent HTTP
CVE-2026-41293 CRITICAL
9.8 May 12

Improper input validation in Apache Tomcat (CWE-20) affects a broad range of releases across the 8.5, 9.0, 10.0, 10.1, a
CVE-2026-43515 CRITICAL
9.1 May 12

Authorization bypass in Apache Tomcat (versions 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54, and 1
CVE-2026-103119 CRITICAL
9.1 Oct 20

Apache Tomcat 11.0.0-M25 through 11.0.26 can split the body of a large non-blocking (NIO) response across the current re
CVE-2026-101356 CRITICAL
9.1 Oct 20

Apache Tomcat 11.0.22-11.0.26, 10.1.55-10.1.60, and 9.0.118-9.0.122 contain an object-recycling race in HTTP/2 processin
CVE-2026-101296 CRITICAL
9.1 Oct 20

Authentication bypass in Apache Tomcat's JNDI realm allows unauthenticated remote attackers to log in without a valid pa
CVE-2026-86350 CRITICAL
9.1 Sep 23

HTTP/2 request smuggling in Apache Tomcat can mix up request headers between concurrent streams, allowing unauthenticate
CVE-2026-43513 HIGH
7.5 May 12

Information disclosure in Apache Tomcat's LockOutRealm component allows remote attackers to bypass account-lockout track

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
ADVISORY https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-29145 ADVISORY https://vuldb.com/vuln/356661 REF http://www.openwall.com/lists/oss-security/2026/04/09/23

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy