CVE-2026-101296 in Tomcat
Summary
by MITRE • 10/20/2026
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
A critical authentication bypass vulnerability has been identified in Apache Tomcat when utilizing the JNDI realm with specific non-GSSAPI SASL authentication mechanisms. This flaw stems from a missing validation step during the authentication handshake process, allowing an attacker to successfully authenticate without providing valid credentials or passwords. The root cause lies in how the server handles the initial challenge-response sequence for certain Simple Authentication and Security Layer (SASL) implementations that do not rely on GSSAPI protocols. In these specific configurations, the application fails to verify the integrity of the authentication response before granting access, effectively rendering the password check obsolete for affected mechanisms. This represents a severe failure in security controls where identity verification is bypassed entirely due to incomplete logic implementation within the realm's authentication handler.
The operational impact of this vulnerability is significant as it allows unauthorized users to gain full administrative or user-level access to applications deployed on vulnerable Tomcat instances without any prior knowledge of valid credentials. An attacker can exploit this by sending a crafted request that triggers the specific SASL mechanism path, resulting in immediate successful login. This bypass undermines the fundamental principle of authentication and can lead to complete compromise of web applications, data exfiltration, privilege escalation, or further lateral movement within an organization's network infrastructure depending on the permissions associated with the default authenticated session. The severity is heightened by the fact that JNDI realms are commonly used in enterprise environments for integrating Tomcat with existing directory services such as LDAP, making this a high-risk issue for organizations relying on centralized identity management.
This vulnerability affects multiple major branches of Apache Tomcat including versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122. Additionally, older end-of-life versions such as 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are also known to be susceptible, although these releases have reached their end of support status. The issue is specifically tied to the configuration where JNDI realm is set up with non-GSSAPI SASL mechanisms, meaning that standard basic or digest authentication methods remain unaffected unless they utilize specific underlying libraries that trigger this code path. Organizations must audit their Tomcat configurations to identify if any instances are running these vulnerable versions and employing the specified authentication setup.
From a classification perspective, this vulnerability aligns with CWE-287 which describes Improper Authentication, specifically where an actor is able to bypass or manipulate identity verification mechanisms. In terms of attack vectors, it relates to ATT&CK technique T1078 Valid Accounts, as attackers can use valid-looking but credential-less sessions to maintain persistence and access within the system. The lack of proper password validation constitutes a fundamental breakdown in security architecture that allows for straightforward exploitation without requiring complex payload delivery or social engineering components beyond network-level interaction with the Tomcat service port.
To mitigate this risk, users are strongly advised to upgrade Apache Tomcat immediately to version 11.0.27, 10.1.61, or 9.0.123, which contain patches addressing the missing validation step in the authentication logic. For environments where upgrading is not immediately feasible due to compatibility constraints with legacy applications, temporary mitigations should be implemented such as restricting network access to Tomcat ports using firewall rules and ensuring that JNDI realms are configured exclusively with GSSAPI SASL mechanisms if those are supported by the directory service provider. Additionally, implementing Web Application Firewalls (WAFs) can provide a layer of detection for anomalous authentication patterns although this is not a substitute for patching the underlying software defect. Regular security audits and configuration reviews should be conducted to ensure that no unsupported or vulnerable versions remain in production environments.