Apache Tomcat EUVD-2026-66135

Exploitation requires three concurrent conditions: (1) Apache Tomcat is configured to use DataSourceRealm as its authentication realm; (2) the application or Tomcat connector is configured to use CLIENT-CERT or SPNEGO as the authentication method - neither is the default for standard Tomcat deployments; (3) the attacker can present a valid client TLS certificate or obtain a valid Kerberos service ticket (requires access to the relevant PKI or Kerberos infrastructure). The authentication bypass is limited to users who do not exist in the datasource but can satisfy the transport-layer credential check. Exploitation is further constrained by the PR:L signal - the attacker is not completely unauthenticated; they require a valid credential artifact at the protocol level. Standard deployments using FORM, BASIC, or DIGEST auth with DataSourceRealm are NOT affected.

The vendor-assigned CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects broad network reach and high impact, but AC:L likely overstates ease of exploitation: the flaw only manifests when Tomcat is explicitly configured with CLIENT-CERT or SPNEGO authentication AND DataSourceRealm - a non-default, operationally deliberate stack that requires infrastructure (PKI or Active Directory/Kerberos). This significantly narrows the real-world attack surface compared to the CVSS surface. EPSS at 0.26% (18th percentile) corroborates low automated exploitation probability. There is no CISA KEV entry and no known public POC. Taken together, this is a genuine, exploitable authentication bypass for organizations using the affected configuration, but it is not a mass-exploitation concern. Defenders using DataSourceRealm with CLIENT-CERT or SPNEGO should treat this as high priority; all others face negligible exposure.

An attacker with a valid TLS client certificate (from any trusted CA, or a self-signed cert if Tomcat's trust anchor is misconfigured) or a valid Kerberos ticket presents credentials for a username that does not exist in the DataSourceRealm database. Tomcat completes the protocol handshake and issues an authenticated session for that non-existent principal, potentially granting access to protected application paths that rely on Realm-based role checks. No public POC has been identified, but the attack logic is straightforward once the configuration preconditions are met.