Skip to main content

Apache Tomcat CVE-2026-55957

| EUVDEUVD-2026-40233 HIGH
Missing Critical Step in Authentication (CWE-304)
2026-06-29 apache GHSA-7895-gffq-w6jq
Information Disclosure Tomcat Apache Apache Tomcat Suse Red Hat
7.3
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
vuln.today AI
4.8 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because it depends on the uncommon JNDIRealm GSSAPI-bind configuration; impact is unauthorized access (C:L/I:L), no direct availability effect (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.3 HIGH
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

4
Analysis Updated
Jun 30, 2026 - 14:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 30, 2026 - 14:22 vuln.today
cvss_changed
CVSS changed
Jun 30, 2026 - 14:22 NVD
7.3 (HIGH)
Analysis Generated
Jun 29, 2026 - 21:16 vuln.today

DescriptionCVE.org

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Articles & Coverage 1

News 5 New Apache Vulnerabilities - 2 Critical, 3 High Severity Jun 30, 2026

AnalysisAI

Authentication bypass in Apache Tomcat (7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.100, 10.1.0-M1-10.1.36, 11.0.0-M1-11.0.4) lets remote attackers authenticate without supplying the correct password when the JNDIRealm is configured to validate credentials via GSSAPI bind. The flaw (CWE-304, Missing Critical Step in Authentication) means the realm accepts a bind as successful even when the password verification step is effectively skipped. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%, 12th percentile), and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability lives in Tomcat's JNDIRealm, the component that delegates container-managed authentication to an external directory service over LDAP/JNDI. When JNDIRealm is set to authenticate by performing a bind to the directory using GSSAPI (Kerberos/SPNEGO) rather than a simple LDAP bind, a critical verification step in the bind/credential-check sequence is missing, so the realm treats the operation as authenticated even when the supplied password is wrong. CWE-304 (Missing Critical Step in Authentication) captures this class precisely: a security-relevant step in the authentication state machine is omitted, collapsing the gate that should distinguish valid from invalid credentials. The single CPE provided (cpe:2.3:a:apache_software_foundation:apache_tomcat) confirms the affected product is the Tomcat servlet/JSP container itself, not a downstream redistribution.

RemediationAI

Vendor-released patch: upgrade to Apache Tomcat 11.0.5, 10.1.37, or 9.0.101, which fix the issue (per the Apache advisory at https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh). Note that the 8.5.x and 7.0.x branches are listed as affected but are end-of-life and received no corresponding fixed release in the advisory, so operators on those branches should migrate to a supported, patched 9.0.101+ line. If immediate patching is not possible, the most direct compensating control is to reconfigure JNDIRealm to not authenticate binds via GSSAPI - for example switch to a standard simple LDAP bind or another Realm implementation - which removes the vulnerable code path entirely; the trade-off is loss of Kerberos/GSSAPI-based directory authentication for those applications and a possible need to re-issue credentials. Where GSSAPI bind must remain, restrict network access to the Tomcat authentication endpoints to trusted networks until the upgrade is applied.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2014-0227 MEDIUM
6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and
CVE-2026-34486 HIGH POC
7.5 Apr 09

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi
CVE-2013-5528 MEDIUM POC
4.0 Oct 11

Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager all
CVE-2016-6808 CRITICAL POC
9.8 Apr 12

Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42. Rated critical severity (CVSS 9.8), this vulnerabili
CVE-2016-1240 HIGH POC
7.8 Oct 03

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debia

Same weakness CWE-304 – Missing Critical Step in Authentication

View all
CVE-2024-8954 CRITICAL POC
9.8
CVE-2024-12048 HIGH POC
8.8
CVE-2022-40622 HIGH POC
8.8
CVE-2022-1065 HIGH POC
8.8
CVE-2022-2821 HIGH POC
7.5
CVE-2024-2172 CRITICAL
9.8
CVE-2024-45764 CRITICAL
9.8
CVE-2022-2302 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

Share

CVE-2026-55957 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy