Apache Tomcat patches eight flaws including authentication bypass in latest release
Apache releases updates for Tomcat 11, 10 and 9 to fix eight vulnerabilities, including an authentication bypass and cross-user data exposure risks.
Key points
- Fixes address CVE-2026-101296, which allows unauthenticated login with specific SASL settings.
- Three flaws are rated Important, while five are rated Low by the Apache Software Foundation.
- Administrators must upgrade to Tomcat 11.0.27, 10.1.61, or 9.0.123 to resolve these issues.
Apache Tomcat has released patches for eight security vulnerabilities, including a flaw that permits attackers to bypass password checks under certain conditions. The Apache Software Foundation disclosed these issues on October 20, 2026, alongside updates for the 11.0, 10.1, and 9.0 release branches.
The most significant issue, CVE-2026-101296, affects systems using JNDIRealm with non-GSSAPI SASL authentication. This missing validation step allows users to authenticate without providing the correct password. Apache rates this flaw as Important, along with two other issues involving data leakage and connection failures.
Context and technical details
Several other vulnerabilities involve improper handling of HTTP/2 requests and AJP responses. CVE-2026-101356 allows requests or responses to mix between users due to incorrect object recycling after processing errors. This creates a risk of cross-user data exposure in affected versions.
CVE-2026-103119 impacts AJP response handling in Tomcat 11 through a buffer under-read during large non-blocking writes. This can split a response body between consecutive requests on the same connection, potentially leaking information from the first response to the second request.
Affected versions and configurations
Not every flaw affects all Tomcat installations, as the issues span different components and version ranges. CVE-2026-101296 affects versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122. Administrators should verify their specific configuration to assess exposure.
Other rated-Low flaws include CVE-2026-88041, which leaks HTTP/2 trailer data, and CVE-2026-93446, which causes intermittent TLS 1.3 failures. CVE-2026-80353 involves a race condition in Unix domain socket creation via the APR/Native connector, potentially allowing unauthorized local access.
What should you do?
Administrators should prioritize upgrading to Tomcat 11.0.27, 10.1.61, or 9.0.123 to eliminate these vulnerabilities. Those unable to patch immediately should review their JNDIRealm authentication settings and disable unused connectors like AJP or HTTP/2 if possible.
What to do and how to stay safe: Apache Tomcat
- Verify your current Tomcat version against the affected ranges listed in the advisory.
- Upgrade to the latest patched release (11.0.27, 10.1.61, or 9.0.123) as soon as operational constraints allow.
- Audit JNDIRealm configurations to ensure non-GSSAPI SASL mechanisms are not in use without additional validation.
- Monitor logs for unusual authentication attempts or HTTP/2 processing errors that might indicate exploitation.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does CVE-2026-101296 affect all Tomcat installations?
No, it only affects installations configured to use JNDIRealm with a non-GSSAPI SASL authentication mechanism.
Which Tomcat versions contain the fixes for these eight flaws?
The fixes are available in Tomcat 11.0.27, 10.1.61, and 9.0.123, depending on the specific branch you are running.
Are there any critical severity vulnerabilities in this release?
No, Apache rates three of the flaws as Important and five as Low; none are rated Critical.
