CVE-2026-59084

Overview

Apache Tomcat is an open-source web server and servlet container, maintained by the Apache Software Foundation, that implements the Jakarta Servlet, Jakarta Pages (JSP), Jakarta Expression Language, and Jakarta WebSocket specifications and provides a pure-Java HTTP environment for running Java web applications.

An incorrectly configured access control vulnerability (CVE-2026-59084) has been identified in the documentation of the Apache Tomcat cluster channel interceptor EncryptInterceptor, which did not clearly state the requirements for configuring the interceptor securely. In particular, the documentation did not state that the EncryptInterceptor must be the final interceptor in a channel's interceptor stack, ignoring the TcpFailureDetector, for it to be effective, and it described the interceptor's confidentiality and integrity protection without that condition. An administrator who followed the documented guidance could therefore deploy a cluster whose encrypted channel is configured in a way that does not provide the protection the documentation describes.

Per CWE-1059: Insufficient Technical Documentation is a weakness where the product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, and operation.

This issue affects multiple versions of Apache Tomcat that ship the cluster EncryptInterceptor and its configuration documentation, including 8.5.38 through the final community release 8.5.100 of the NES-supported 8.5.x line.

Module Info

• Product: Apache Tomcat
• Affected packages: the EncryptInterceptor configuration documentation shipped in the Apache Tomcat distribution (the cluster-interceptor reference in the docs web application); the documented component is org.apache.tomcat:tomcat-tribes
• Affected versions: >=8.5.38 <=8.5.100
• GitHub repository: https://github.com/apache/tomcat
• Published packages: https://central.sonatype.com/artifact/org.apache.tomcat/tomcat-tribes (the affected documentation ships inside the Apache Tomcat binary distribution rather than as a Maven library artifact)
• Package manager: Maven
• Fixed in: NES for Apache Tomcat 8.5.100-tomcat-8.5.109 (upstream fixed in Apache Tomcat 9.0.120, 10.1.57, and 11.0.24)

Vulnerability Info

This Low-severity vulnerability is found in the documentation for the org.apache.tomcat:tomcat-tribes package in multiple versions of Apache Tomcat. Tomcat clustering can wrap the inter-node Tribes group channel with org.apache.catalina.tribes.group.interceptors.EncryptInterceptor, which encrypts the channel messages carrying session data between nodes. A Tribes channel is built from a stack of interceptors, and the order in which they are declared in server.xml is the order of the stack: a message sent from a node passes through the interceptors in that order, and a message received by a node passes through them in reverse order.

The configuration reference did not describe this ordering, and its entry for the EncryptInterceptor did not state that the interceptor must be the final interceptor in the channel's stack, ignoring the TcpFailureDetector, for it to be effective. The cluster overview pages additionally stated that the EncryptInterceptor provides confidentiality and integrity protection without qualifying that statement with the requirement that it be correctly configured. An administrator who enabled the interceptor and placed it elsewhere in the stack could reasonably, but wrongly, believe the cluster channel was protected.

Practical exposure is limited to deployments where Tomcat clustering is enabled with the EncryptInterceptor configured on the Tribes channel, and it requires an attacker who can already observe or send traffic on the cluster network, which is consistent with the Low severity assigned by the Apache Tomcat security team.

Mitigation

Only recent major lines of Apache Tomcat are community-supported. The affected 8.5.x line reached End-of-Life on March 31, 2024 (final community release 8.5.100) and will not receive public updates to address this issue.

Regardless of Tomcat version, administrators using the EncryptInterceptor should declare it as the final interceptor in the channel's interceptor list in server.xml, ignoring the TcpFailureDetector, as the corrected documentation requires, and should review the order of the remaining interceptors against the corrected ordering guidance.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported Apache Tomcat major line (9.0.x or later) that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• NDIx (finder)