Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-101296: Apache Tomcat lets attackers bypass login with some SASL methods
CVE-2026-101296 · published 3 days ago
Summary
Tomcat's JNDIRealm component does not correctly check credentials when non‑GSSAPI SASL authentication is used, allowing a user to log in without a valid password. This can let attackers gain access to protected applications hosted on the server. Install the latest Tomcat updates from your distribution or disable the affected SASL mechanisms until a fix is applied.
What to do
- Update debian tomcat9 to version 9.0.70-2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apache software foundation | apache tomcat | <= 11.0.26 |
| Debian:13 | debian | tomcat11 | All versions |
| Debian:12 | debian | tomcat10 | All versions |
| Debian:12 | debian | tomcat9 |
< 9.0.70-2 Fix: upgrade to 9.0.70-2
|
| Ubuntu:Pro:14.04:LTS | canonical | tomcat6 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | tomcat7 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | tomcat8 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | tomcat9 | All versions |
| Ubuntu:24.04:LTS | canonical | tomcat10 | All versions |
| Ubuntu:26.10 | canonical | tomcat11 | All versions |
Original advisory text
Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
References
- https://lists.apache.org/thread.html/bl52b9go9ckoov8x4v3dt6rkm573cygd vendor-advisory
- http://www.openwall.com/lists/oss-security/2026/10/20/26
- https://security-tracker.debian.org/tracker/CVE-2026-101296 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-101296 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-101296 Third Party Advisory
- https://github.com/apache/tomcat/commit/e43453fc04abb44f64faf571ca98af71aa3c20a1 Third Party Advisory
- https://github.com/apache/tomcat/commit/8fafc6f263311b7a0b7ce67477822175d1adf7ce Third Party Advisory
- https://github.com/apache/tomcat/commit/42827afa4d073ac3d9f8b3cc81b857aa455bf1e6 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-304Missing Critical Step in Authentication
Timeline
Published20 Oct 2026
Updated23 Oct 2026
First seen20 Oct 2026
Sources
CVE-2026-101296 · NVD
CVE-2026-101296 · MITRE
DEBIAN-CVE-2026-101296 · OSV
UBUNTU-CVE-2026-101296 · OSV
Track software like this
Free during beta