Apache Tomcat: critical authentication bypass (CVE-2026-101296) and other flaws fixed in 11.0.27, 10.1.61 and 9.0.123
Published 25/10/2026 17:53
Timeline
3 events over 10 d
- 15/10/2026 09:42CorroboratedFull Disclosure mailing list+5 d 16 h
- 21/10/2026ConfirmedCERT-FR advisories+4 d 16 h
- 25/10/2026 17:53Published on WatchtowerPro CISO
In short
Apache has fixed several Apache Tomcat vulnerabilities in versions 11.0.27, 10.1.61 and 9.0.123. The most serious is CVE-2026-101296, an authentication bypass in JNDIRealm. When JNDIRealm uses a SASL mechanism other than GSSAPI (Kerberos), an attacker can log in without the correct password. It is rated 9.1 (CVSS v4.0).
Affected versions
- CVE-2026-101296 (JNDIRealm authentication bypass): Tomcat 11.0.0-M1 to 11.0.26, 10.1.0-M1 to 10.1.60 and 9.0.0.M1 to 9.0.122. It matters only if JNDIRealm is configured with a SASL mechanism other than GSSAPI.
- CVE-2026-101296 also affects the end-of-life branches 8.5.0 to 8.5.100 and 7.0.0 to 7.0.109. The vendor says other unsupported versions may also be affected.
- CVE-2026-101356 (HTTP/2 with asynchronous servlets): Tomcat 11.0.22 to 11.0.26, 10.1.55 to 10.1.60 and 9.0.118 to 9.0.122.
- CVE-2026-88041 (trailer data leaking into the next request): Tomcat 11.0.0-M23 to 11.0.26, 10.1.27 to 10.1.60 and 9.0.92 to 9.0.122.
- Unix domain socket race condition in the APR/Native connector (CVE-2026-80353, CVE-2026-65183): Tomcat 9.0.47 to 9.0.122.
- Embedded Tomcat, for example the tomcat-embed-core library used by Spring Boot, is affected in the same way and must be upgraded.
Fixed in
- 11.0 branch: 11.0.27
- 10.1 branch: 10.1.61
- 9.0 branch: 9.0.123
- 8.5: no fix
- 7.0: no fix
What to do now
- Update Apache Tomcat to a fixed version: 11.0.27 for the 11.0 branch, 10.1.61 for the 10.1 branch, or 9.0.123 for the 9.0 branch. This is the only real fix.
- If your application embeds Tomcat (for example Spring Boot with tomcat-embed-core), upgrade that library to 11.0.27, 10.1.61 or 9.0.123 and redeploy the application.
- If you still run Tomcat 8.5.x or 7.0.x, plan a move to a supported branch (11.0, 10.1 or 9.0). These branches will get no fix for CVE-2026-101296.
- Until you can update: check server.xml and context.xml for a JNDIRealm that uses SASL. If one is configured, switch it to the Kerberos GSSAPI mechanism and remove any other SASL mechanism, as Red Hat advises.
- Interim measures only reduce exposure. They do not make the server safe; only the update does.
- If you use a vendor product that bundles Tomcat, ask that vendor for its release that includes Tomcat 11.0.27, 10.1.61 or 9.0.123.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 6 sources with their dates. And technology matching: which of your systems run Apache Tomcat, at which version, fixed or not - and what each one needs.
Main sources
Multiples vulnérabilités dans Apache Tomcat (21 octobre 2026) CERT · [0day-rubbish] Synametrics Syncrify 6.2 build 1178 authenticated PublicLink chunk-upload path traversal to /etc/cron.d and root command execution (7.5) Research · [0day-rubbish] Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT anonymous deserialization in the database restore path to JSP command execution as uid=1000 (9.8) Research