CVE-2026-15554 in Undertow
Summary
by MITRE • 08/11/2026
the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability resides in the Undertow web server's implementation of the Apache Jserv Protocol (AJP) listener which fails to properly authenticate AJP attributes related to SSL certificate information and secure connection status. This weakness allows an unauthenticated attacker who has direct TCP access to the AJP port 8009 to manipulate the ssl_cert and is_ssl attributes in AJP packets without presenting any shared-secret authentication mechanism. The flaw directly impacts the server's ability to verify client certificates and establish secure connections, creating a critical bypass opportunity for malicious actors.
The technical implementation flaw stems from the absence of proper authentication checks for AJP attributes that should normally require verification against a shared secret or cryptographic token. According to CWE-310, this represents a weakness in cryptographic key management where sensitive attributes are accepted without proper validation. The AJP protocol typically operates as a binary protocol between web servers and application servers, with the ssl_cert attribute containing X.509 certificate information and is_ssl indicating secure connection status. When these attributes are accepted without verification, they can be easily forged by any attacker with network access to port 8009.
This vulnerability creates significant operational impact as it allows attackers to bypass client certificate authentication mechanisms that are typically required for secure applications. The attack vector requires only direct TCP access to the AJP listener port, eliminating the need for complex exploitation techniques or privilege escalation. From an ATT&CK framework perspective, this maps to T1566 (Phishing for Information) and T1071.004 (Application Layer Protocol: DNS) where attackers can manipulate protocol attributes to gain unauthorized access. The vulnerability essentially allows an attacker to inject a forged X.509 certificate that the server will accept as legitimate, effectively bypassing SSL/TLS client authentication requirements.
The mitigation strategies should focus on implementing proper shared-secret authentication for AJP attributes or disabling the AJP listener entirely if it's not required for the application architecture. Organizations should consider network-level access controls to restrict direct TCP access to port 8009, implement proper firewall rules, and ensure that AJP communication occurs only within trusted network segments with appropriate authentication mechanisms in place. Additionally, upgrading to patched versions of Undertow where proper attribute validation has been implemented will address the core vulnerability. The solution aligns with security best practices outlined in NIST SP 800-53 and ISO/IEC 27001 controls for access control and cryptographic key management.