CVE-2026-101296None▾ SunlitA missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
apache_tomcat >= 11.0.0-M1 <= 11.0.26apache_tomcat >= 10.1.0-M1 <= 10.1.60apache_tomcat >= 9.0.0.M1 <= 9.0.122apache_tomcat >= 8.5.0 <= 8.5.100apache_tomcat >= 7.0.0 <= 7.0.109Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-74049NoneApache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
CVE-2026-74048NoneApache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
CVE-2026-80353NoneApache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
CVE-2026-88041NoneApache Tomcat: HTTP/2 trailer header cross-contamination
CVE-2026-101356NoneApache Tomcat: HTTP/2 request/response mix-up after error during async processing
CVE-2026-93446NoneApache Tomcat: Possible TLS 1.3 connection failures