Skip to main content

Apache Tomcat CVE-2026-34486

| EUVDEUVD-2026-21056 HIGH
Missing Encryption of Sensitive Data (CWE-311)
2026-04-09 apache GHSA-69r9-qgr7-g2wj
Apache Information Disclosure Tomcat Apache Tomcat Apache Software Foundation
7.5
CVSS 3.1 · Vendor: apache
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify clustered Tomcat deployment on versions 11.0.20/10.1.53/9.0.116
  2. Exploit
    Gain network access to cluster replication segment
  3. Execution
    Intercept plaintext cluster replication traffic bypassing EncryptInterceptor
  4. Impact
    Extract sensitive session tokens and application state data

Vulnerability Assessment

Weakness
CWE
CWE-311
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V14 - Data Protection Encryption of sensitive data
Exploitation Conditions

Exploitation requires that the target Tomcat instance be deployed in a clustered configuration with the EncryptInterceptor enabled - clustering is not enabled by default in Apache Tomcat, so single-instance deployments are not affected. Only versions 11.0.20, 10.1.53, and 9.0.116 are vulnerable; versions that never applied the CVE-2026-29146 fix or that have already upgraded to 11.0.21, 10.1.54, or 9.0.117 are not affected. The attacker must have network-level access to the inter-node cluster replication channel, typically an internal network segment or VLAN. No authentication to the Tomcat application is required; however, the attacker must be network-adjacent to or on the cluster communication path. Exploitation is limited to confidentiality impact - session data interception - and does not provide integrity or availability impact per the CVSS vector.
Impact

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N assigns a 7.5 base score reflecting a network-accessible, unauthenticated, low-complexity attack yielding high confidentiality impact. However, the intelligence signals conflict materially: CISA KEV lists this as actively exploited, yet SSVC rates exploitation as 'none' and EPSS is at 0.01% (1st percentile). This divergence is unexplained by available data and should be independently verified - the KEV listing may reflect confirmed targeted incidents not yet reflected in broader exploitation telemetry. SSVC's 'automatable: yes' indicates the attack can be scripted once a target is identified. The affected population is narrow - only three specific point releases are vulnerable - limiting blast radius to organizations that recently patched CVE-2026-29146 and have not yet re-patched. A further anomaly: two Vicarius reference links label this 'RCE on Apache Tomcat,' which contradicts the CVE description and the CVSS vector (C:H/I:N/A:N indicates confidentiality-only impact, not code execution). Those references should be treated with caution. Priority should nonetheless remain high given KEV listing and patch availability.
Exploit ScenarioDerived

An attacker who has gained a foothold on a host within the same data center VLAN or cloud subnet as a Tomcat cluster deploys a passive packet capture tool targeting the cluster replication port. Because the EncryptInterceptor bypass causes replication traffic to traverse the wire as plaintext, the attacker reads session tokens and other sensitive application state replicated between nodes without any authentication. A publicly available exploit simplifies this capture and data extraction step.
Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.
Exploited in the wild (CISA KEV) Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv4 – Aug 06, 2026

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive session data to network-positioned attackers because the EncryptInterceptor - the clustering security control - can be bypassed due to a regression introduced by the fix for CVE-2026-29146. Listed in CISA KEV as actively exploited with a publicly available exploit, though EPSS sits at just 0.01% (1st percentile), indicating targeted rather than widespread automated exploitation. The confidentiality impact is rated High with no integrity or availability impact, consistent with CWE-311 (Missing Encryption of Sensitive Data).

Earlier versions of this analysis (3)
v3 Aug 06, 2026 - 22:55 cvss changed CVSS 7.5

Sensitive cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 is transmitted without encryption because the EncryptInterceptor can be bypassed, exposing session data and credentials to network interception. This is a failed remediation of CVE-2026-29146 - the original patch introduced the bypass condition rather than eliminating the root encryption gap. Confirmed actively exploited per CISA KEV, with publicly available exploit code; however, SSVC exploitation status is listed as 'none' and EPSS sits at only 0.01% (1st percentile), signaling targeted rather than widespread exploitation at time of analysis.

v2 Aug 05, 2026 - 14:28 cvss changed CVSS 9.8

Sensitive-data exposure in Apache Tomcat's cluster communication affects versions 11.0.20, 10.1.53, and 9.0.116, where the fix for CVE-2026-29146 introduced a regression that lets attackers bypass the EncryptInterceptor. Because the interceptor fails to encrypt inter-node traffic as intended, an attacker positioned on the cluster network can read (and potentially tamper with) replicated session data that operators believed was protected. It is listed in CISA KEV as actively exploited and public exploit/detection code exists, though EPSS is only 0.01% and CISA's SSVC records exploitation as 'none' - signals that conflict and warrant scrutiny.

v1 Apr 09, 2026 - 20:15 CVSS 7.5

Encryption bypass in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 allows unauthenticated remote attackers to circumvent the EncryptInterceptor component, exposing sensitive data in cleartext. The vulnerability stems from an incomplete fix for CVE-2026-29146, enabling network-accessible adversaries to access confidential information without authentication. CVSS 7.5 (High severity) reflects network-based exploitation with low complexity and high confidentiality impact. No public exploit identified at time of analysis; low observed exploitation activity (EPSS <1%).

RemediationAI

Upgrade to Apache Tomcat 11.0.21, 10.1.54, or 9.0.117 as applicable to the deployed branch; these versions are confirmed by the Apache Software Foundation as the corrective releases per the advisory at https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly. Red Hat customers should consult RHSA-2026:36787 through RHSA-2026:36790 and RHSA-2026:36876 through RHSA-2026:36877 at https://access.redhat.com/errata/ for platform-specific errata. If immediate patching is not feasible in clustered deployments, isolate cluster replication traffic to a dedicated network segment with strict ACLs permitting only known cluster node IPs - this reduces the interception surface but does not eliminate the plaintext exposure. Disabling clustering entirely removes the vulnerability but sacrifices session replication and high-availability capabilities. Note that the vulnerability is only exploitable in clustered Tomcat deployments with EncryptInterceptor configured; single-instance deployments require no action.

Affected VersionsENISA

Apache Tomcat 11.0.20
Apache Tomcat 9.0.116
Apache Tomcat 10.1.53

Affected Packages

maven org.apache.tomcat.embed:tomcat-embed-core fix: 9.0.117, 10.1.54, 11.0.21
maven org.apache.tomcat:tomcat fix: 9.0.117, 10.1.54, 11.0.21
maven org.apache.tomcat:tomcat-catalina fix: 9.0.117, 10.1.54, 11.0.21
maven org.apache.tomcat:tomcat-tribes fix: 9.0.117, 10.1.54, 11.0.21
euvd apache_tomcat no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 5 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Apache Tomcat's clustering subsystem uses an EncryptInterceptor to encrypt session replication and other state data transmitted between cluster nodes over the network. CWE-311 (Missing Encryption of Sensitive Data) is the root cause class: the security control exists but is ineffective due to a bypass path. The regression was introduced specifically by the patch for CVE-2026-29146, meaning only deployments that applied that prior fix - landing on exactly versions 11.0.20, 10.1.53, or 9.0.116 - are affected. CPE cpe:2.3:a:apache_software_foundation:apache_tomcat covers the affected product. The bypass allows cluster traffic that should be encrypted in transit to travel as plaintext, exposing whatever sensitive application data is replicated across nodes.

Know when Apache Tomcat gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI 7.5 MEDIUM

Network-accessible cluster traffic interception requires no privileges or user interaction; only confidentiality is impacted as plaintext session data is exposed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

10
Analysis Updated
Aug 06, 2026 - 22:56 vuln.today
v4 - CVSS changed
Analysis Updated
Aug 06, 2026 - 22:55 vuln.today
v3 - CVSS changed
Severity Changed
Aug 06, 2026 - 22:22 NVD
CRITICAL HIGH
CVSS changed
Aug 06, 2026 - 22:22 NVD
9.8 (CRITICAL) 7.5 (HIGH)
Analysis Updated
Aug 05, 2026 - 14:28 vuln.today
v2 - CVSS changed
Severity Changed
Aug 05, 2026 - 14:22 NVD
HIGH CRITICAL
CVSS changed
Aug 05, 2026 - 14:22 NVD
7.5 (HIGH) 9.8 (CRITICAL)
Added to CISA KEV
Aug 04, 2026 - 17:16 CISA
Patch released
Apr 11, 2026 - 02:30 nvd
Patch available
CVE Published
Apr 09, 2026 - 19:35 nvd
HIGH 7.5

DescriptionCVE.org

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Executive ViewAI

Why It Matters

Apache Tomcat deployments with cluster replication are vulnerable to unencrypted session traffic interception, exposing authenticated user credentials and session tokens to network attackers; this actively exploited flaw affects versions 9.0.116, 10.1.53, and 11.0.20. For organizations relying on Tomcat for multi-instance deployments, this creates a direct pathway to user account compromise without detection. Immediate patching is required to restore encryption protections on inter-node traffic.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

Threat Score
4.5/10
Composite threat intelligence
EPSS Score
0.0%
Top 99% exploitable
Prevalence
High
widely deployed Java application server across enterprise and cloud environments
Threat Intel
1
1 sources
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org CISA KEV EPSS Vulnrichment GHSA POC (1) Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV Yes
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
In CISA KEV with patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

108
Low Medium High Critical
KEV: +50
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Apache Tomcat

View all
CVE-2026-29146 HIGH POC
7.5 Apr 09

Padding oracle attack in Apache Tomcat EncryptInterceptor leaks encrypted session data confidentiality across versions 7
CVE-2026-50229 MEDIUM POC
6.1 Jun 29

Reflected XSS in Apache Tomcat's bundled 'number guess' example application exposes users of that demo page to script in
CVE-2026-76183 CRITICAL
9.8 Sep 23

Authentication bypass in Apache Tomcat allows unauthenticated remote attackers to reach WebSocket endpoints that are sup
CVE-2026-43512 CRITICAL
9.8 May 12

Authentication bypass in Apache Tomcat's DIGEST authentication implementation allows remote attackers to circumvent HTTP
CVE-2026-41293 CRITICAL
9.8 May 12

Improper input validation in Apache Tomcat (CWE-20) affects a broad range of releases across the 8.5, 9.0, 10.0, 10.1, a
CVE-2026-29145 CRITICAL
9.1 Apr 09

Authentication bypass in Apache Tomcat 9.x through 11.x and Tomcat Native 1.1.23-2.0.13 allows unauthenticated remote at
CVE-2026-43515 CRITICAL
9.1 May 12

Authorization bypass in Apache Tomcat (versions 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54, and 1
CVE-2026-103119 CRITICAL
9.1 Oct 20

Apache Tomcat 11.0.0-M25 through 11.0.26 can split the body of a large non-blocking (NIO) response across the current re
CVE-2026-101356 CRITICAL
9.1 Oct 20

Apache Tomcat 11.0.22-11.0.26, 10.1.55-10.1.60, and 9.0.118-9.0.122 contain an object-recycling race in HTTP/2 processin
CVE-2026-101296 CRITICAL
9.1 Oct 20

Authentication bypass in Apache Tomcat's JNDI realm allows unauthenticated remote attackers to log in without a valid pa
CVE-2026-86350 CRITICAL
9.1 Sep 23

HTTP/2 request smuggling in Apache Tomcat can mix up request headers between concurrent streams, allowing unauthenticate
CVE-2026-43513 HIGH
7.5 May 12

Information disclosure in Apache Tomcat's LockOutRealm component allows remote attackers to bypass account-lockout track

Same weakness CWE-311 – Missing Encryption of Sensitive Data

View all
CVE-2017-8221 HIGH POC
7.5
CVE-2019-11367 CRITICAL POC
9.8
CVE-2025-69969 CRITICAL POC
9.6
CVE-2019-18800 HIGH POC
8.8
CVE-2017-6445 HIGH POC
8.1
CVE-2019-5448 HIGH POC
8.1
CVE-2018-5261 HIGH POC
8.1
CVE-2022-26281 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

References

Advisories & patches
ADVISORY https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34486 ADVISORY https://vuldb.com/vuln/356676 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-34486 REF https://access.redhat.com/errata/RHSA-2026:36787 REF https://access.redhat.com/errata/RHSA-2026:36788 REF https://access.redhat.com/errata/RHSA-2026:36789 REF https://access.redhat.com/errata/RHSA-2026:36790 REF https://access.redhat.com/errata/RHSA-2026:36876 REF https://access.redhat.com/errata/RHSA-2026:36877 REF https://access.redhat.com/errata/RHSA-2026:36878 REF https://access.redhat.com/errata/RHSA-2026:36879 REF https://access.redhat.com/errata/RHSA-2026:37136 REF https://access.redhat.com/errata/RHSA-2026:37137 REF https://access.redhat.com/errata/RHSA-2026:38505 REF https://access.redhat.com/errata/RHSA-2026:39188 REF https://access.redhat.com/errata/RHSA-2026:39189 REF https://access.redhat.com/security/cve/CVE-2026-34486 REF https://bugzilla.redhat.com/show_bug.cgi?id=2457027 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json REF https://socradar.io/blog/snowlight-government-chinese-campaign/ REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486 REF https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat REF https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy