Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-10-20T13:45:39 tomcat: tomcat: Authentication bypass via non-GSSAPI SASL in JNDI realm 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CWE-303

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

A flaw was found in Apache Tomcat. When the Java Naming and Directory Interface (JNDI) realm is configured with a non-Generic Security Service Application Program Interface (GSSAPI) Simple Authentication and Security Layer (SASL) mechanism, a missing verification step allows an attacker to bypass authentication without providing the correct password. An unauthenticated remote attacker can exploit this vulnerability to gain unauthorized access to protected resources.

A flaw was found in Apache Tomcat. When the JNDIRealm is configured with a non-GSSAPI SASL authentication mechanism, a missing verification step allows an unauthenticated remote attacker to bypass authentication without supplying valid credentials. Successful exploitation grants unauthorized access to protected web applications and administrative resources hosted on the Tomcat instance, restricted by the operating context and system privileges of the Tomcat process. The highest-value action is to reconfigure Tomcat JNDIRealm to enforce Kerberos GSSAPI authentication and eliminate non-GSSAPI SASL authentication mechanisms: upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123 (or the fixed Tomcat builds), which verify credentials properly during non-GSSAPI SASL authentication in JNDIRealm, closing unauthenticated request to protected realm using non-GSSAPI SASL credentials. Until patched, this is a concern on Tomcat deployments with JNDIRealm configured with a non-GSSAPI SASL authentication mechanism, so restrict network access to endpoints protected by the JNDI realm and avoid using non-GSSAPI SASL authentication configurations. As a compensating measure, intercept and authenticate inbound requests at an identity-aware gateway before they reach the vulnerable Tomcat JNDI realm. Red Hat Hardened Images 2026-10-12T00:00:00Z RHSA-2026:81365 tomcat11-main-11.0.27-0.1.hum1 Red Hat Hardened Images 2026-10-20T00:00:00Z RHSA-2026:85926 tomcat10-main-10.1.61-0.1.hum1 Red Hat Enterprise Linux 10 Affected tomcat Red Hat Enterprise Linux 10 Affected tomcat9 Red Hat Enterprise Linux 6 Affected tomcat6 Red Hat Enterprise Linux 7 Affected tomcat Red Hat Enterprise Linux 8 Affected pki-deps:10.6/pki-servlet-engine Red Hat Enterprise Linux 8 Affected tomcat Red Hat Enterprise Linux 9 Affected pki-servlet-engine Red Hat Enterprise Linux 9 Affected tomcat Red Hat Hardened Images Not affected hi/tomcat Red Hat JBoss Web Server 5 Not affected jws5-tomcat Red Hat JBoss Web Server 6 Affected jws6-tomcat Red Hat JBoss Web Server 7 Affected jws7-tomcat https://www.cve.org/CVERecord?id=CVE-2026-101296 https://nvd.nist.gov/vuln/detail/CVE-2026-101296 https://lists.apache.org/thread.html/bl52b9go9ckoov8x4v3dt6rkm573cygd