CVE-2026-101296

Overview

Apache Tomcat is an open-source implementation of the Jakarta Servlet, Jakarta Pages, Jakarta Expression Language, Jakarta WebSocket, Jakarta Annotations, and Jakarta Authentication specifications. It serves Java web applications either as a standalone servlet container and HTTP server or embedded inside an application through the tomcat-embed-core artifact. Its Catalina servlet container (org.apache.tomcat:tomcat-catalina) supplies the request-processing pipeline, including Valves such as RewriteValve, along with connectors, realms, and session management.

An authorization bypass vulnerability (CVE-2026-101296) has been identified in the JNDIRealm of Apache Tomcat, which allows attackers to authenticate without providing the correct password when the realm is configured with a SASL authentication mechanism other than GSSAPI.

Per OWASP: Confirmation of the user's identity, authentication, and session management is critical to protect against authentication-related attacks.

This issue affects multiple versions of Apache Tomcat.

Details

Module Info

• Product: Apache Tomcat
• Affected packages: org.apache.tomcat:tomcat-catalina, org.apache.tomcat.embed:tomcat-embed-core
• Affected versions: >=11.0.0-M1 <=11.0.26, >=10.1.0-M1 <=10.1.60, >=9.0.0.M1 <=9.0.122, >=8.5.0 <=8.5.100, >=7.0.0 <=7.0.109
• GitHub repository: https://github.com/apache/tomcat
• Published packages: https://central.sonatype.com/artifact/org.apache.tomcat/tomcat-catalina, https://central.sonatype.com/artifact/org.apache.tomcat.embed/tomcat-embed-core
• Package manager: Maven
• Fixed in:
• OSS Apache Tomcat 9.0.123, 10.1.61, 11.0.27
• NES for Apache Tomcat 8.5.100-tomcat-8.5.113

Vulnerability Info

This High-severity vulnerability is found in the org.apache.tomcat:tomcat-catalina package in multiple versions of Apache Tomcat. When JNDIRealm is configured to validate users by binding to the directory as the user, it checks a password by placing the user's DN and the supplied password in the directory context as Context.SECURITY_PRINCIPAL and Context.SECURITY_CREDENTIALS and then forcing an LDAP bind. The realm's authentication attribute is copied into Context.SECURITY_AUTHENTICATION when the directory context is created, and the credential check reuses that setting. The only mechanism it switches away from is GSSAPI:

userCredentialsAdd(context, dn, credentials);
// Need to make sure GSSAPI SASL authentication is not used if configured
if (AUTHENTICATION_NAME_GSSAPI.equals(preservedEnvironment.get(Context.SECURITY_AUTHENTICATION))) {
    context.removeFromEnvironment(Context.SECURITY_AUTHENTICATION);
}
...
context.getAttributes("", null);
validated = true;

When the realm is configured with any other SASL mechanism, the bind that is supposed to prove the user knows the password goes through that mechanism instead of a simple bind, so it does not necessarily test the supplied password. The bind can then succeed, getAttributes returns without an AuthenticationException, and bindAsUser reports the credentials as valid. An attacker can therefore authenticate to web applications protected by the realm without providing the correct password. Tomcat's documentation states that a simple bind is used for this check, but the code does not enforce it.

Mitigation

Only recent versions of Apache Tomcat are community-supported, and older versions are End-of-Life. The community support version will not receive any updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a patched version of Apache Tomcat.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Sai Sreewathsa Kovalluri from Innspark Solutions Private Limited (finder)
• Shon Babu from Innspark Solutions Private Limited (finder)
• Kannan K from Innspark Solutions Private Limited (finder)