CVE-2026-86248 in Tomcat
Summary
by MITRE • 09/23/2026
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability in Apache Tomcat regarding CLIENT_CERT authentication represents a critical deviation from expected security behavior when soft fail mechanisms are explicitly disabled. In standard SSL/TLS configurations utilizing mutual authentication, the server requires clients to present valid certificates signed by trusted Certificate Authorities. The concept of soft fail typically allows connections to proceed even if certificate validation encounters non-fatal errors or missing information, often for backward compatibility with older client implementations. However, when administrators configure Tomcat to disable this soft fail behavior, they intend to enforce strict security policies where any deviation from the required authentication standards results in an immediate connection rejection. The identified flaw indicates that under specific operational scenarios, the server fails to properly terminate these connections despite the explicit configuration directive, thereby allowing unauthorized or improperly authenticated clients to establish sessions with the application server.
This technical flaw stems from inconsistencies in how Tomcat processes certificate validation outcomes within its connector implementation. When soft fail is disabled, the authentication module should treat any failure in verifying the client's identity as a hard error that aborts the handshake process immediately. Instead, certain code paths allow the connection to persist even when critical verification steps are incomplete or result in invalid states. This behavior undermines the principle of least privilege and strict access control by effectively bypassing the intended authentication gatekeeper. The issue affects multiple major versions of Apache Tomcat, specifically ranging from 11.0.0-M14 through 11.0.25, 10.1.22 through 10.1.59, and 9.0.92 through 9.0.121, indicating a systemic issue in the authentication logic that has persisted across several release cycles until its recent correction.
The operational impact of this vulnerability is significant for environments relying on mutual TLS for securing sensitive internal services or external-facing APIs. Attackers who can intercept network traffic may exploit this flaw to bypass client certificate requirements, potentially gaining unauthorized access to protected resources without possessing valid credentials. This constitutes a form of authentication bypass where the security control designed to verify identity is rendered ineffective under specific conditions. From an industry standard perspective, this aligns with CWE-287 Improper Authentication and CWE-306 Missing Check for Incorrect Authentication, as the system fails to correctly validate the presented credentials against policy requirements. Furthermore, in terms of MITRE ATT&CK frameworks, this vulnerability facilitates techniques related to Credential Access or Initial Access by allowing adversaries to circumvent authentication mechanisms that are supposed to be strictly enforced.
To mitigate this risk and restore intended security postures, organizations running affected versions must upgrade Apache Tomcat immediately to version 11.0.26, 10.1.60, or 9.0.122. These releases contain the necessary patches that correct the logic errors in the CLIENT_CERT authentication handler, ensuring that disabled soft fail settings are strictly respected during SSL handshake negotiations. Administrators should also verify their current configuration to ensure that mutual TLS is properly implemented and monitored for any anomalous connection attempts that might indicate exploitation of this flaw prior to patching. Regular updates and adherence to vendor security advisories remain essential practices for maintaining the integrity of web application infrastructure against evolving threats.