Apache Apache Tomcat — A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was…

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.

WeaknessCWE-304

Published 20 Oct 2026, 14:16 UTCUpdated 21 Oct 2026, 04:16 UTCSource NVD

Read vendor advisory View on NVD

CVSS 4.0

9.1

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploit chance, 30 days

0.6%

Higher than 50% of all CVEs (EPSS)

Status

No known exploitation

Not in CISA KEV

Patch

Unknown

Check the vendor advisory

What happened

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

What to do

01Check whether you run Apache Tomcat, and which version.
02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

20 Oct 14:16Published to NVD
21 Oct 04:16NVD record updated

Also actively exploited

Vendor

Apache45 CVEs in 30 days

All Apache CVEs

Other CVEs in Apache Tomcat

2 more CVEs

All Apache Tomcat CVEs

9.1Apache Apache Tomcat — Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could…CVE-2026-103119Apache Tomcat2 weeks agoEPSS 0.6%9.1Apache Tomcat — race condition.CVE-2026-101356Apache Tomcat2 weeks agoEPSS 0.5%