CVE-2026-65182 in Tomcat
Summary
by MITRE • 08/25/2026
Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability described constitutes a critical flaw in Apache Tomcat's security constraint resolution logic, specifically categorized under Improper Access Control and Incorrect Authorization. This defect arises from an algorithmic error in how the web container evaluates URL patterns against defined security constraints within the deployment descriptor or programmatic configuration. The core technical issue is that when multiple security constraints are configured with overlapping path prefixes, Tomcat historically prioritized the first matching constraint found rather than applying a longest-prefix-match strategy. This behavior deviates from standard servlet specification expectations and common web server access control models where more specific paths should override broader ones to enforce granular security policies.
In an operational context, this flaw allows attackers to bypass authentication or authorization requirements by exploiting the order in which constraints are defined. If an administrator defines a broad constraint allowing public access for a long path such as /app/admin/legacy before defining a restrictive constraint requiring admin privileges for a shorter sub-path like /app/admin/, the broader rule takes precedence. Consequently, any request targeting URLs under /app/admin/ will be evaluated against the first matching pattern, which permits unauthenticated or unauthorized access. This effectively neutralizes security controls intended to protect sensitive administrative interfaces, configuration endpoints, or internal APIs that rely on strict role-based access control mechanisms.
The impact of this vulnerability is severe for applications relying on Tomcat as their servlet container. Attackers can exploit the misconfiguration to gain unauthorized access to restricted resources without valid credentials. This could lead to data exfiltration, privilege escalation within the application layer, or further exploitation if sensitive administrative functions are exposed. The flaw affects a wide range of Apache Tomcat versions spanning from legacy 7.x releases through recent 10.x and early 11.x milestones, indicating that this has been a persistent architectural weakness in the container's security constraint matching engine for many years. Organizations running these versions face significant risk if their application configurations do not strictly adhere to ordering best practices or rely on implicit assumptions about path precedence.
To mitigate this vulnerability, immediate upgrade is required as specified by the vendor. Users must migrate to Apache Tomcat version 11.0.25, 10.1.58, or 9.0.121, where the constraint resolution logic has been corrected to properly handle path specificity and ordering. For environments unable to upgrade immediately due to compatibility constraints, a temporary mitigation involves reviewing all security-constraint definitions in web.xml files. Administrators should ensure that more restrictive constraints for shorter paths are defined before broader constraints for longer parent paths. This manual reordering ensures that the container evaluates specific restrictions first, thereby enforcing the intended access control policies until the software can be patched to handle this automatically and correctly according to industry standards such as CWE-269 Improper Privilege Management and ATT&CK technique T1078 Valid Accounts for unauthorized persistence or lateral movement.