Apache Tomcat releases 11.0.27, 10.1.61, 9.0.123 patch critical JNDI realm auth bypass CVE-2026-101296

Apache Software Foundation released updates on October 20 to fix a critical authentication bypass in Apache Tomcat. The vulnerability, identified as CVE-2026-101296, allows attackers to log in without providing the correct password under specific configuration conditions. This flaw was disclosed by Mark Thomas on the oss-security mailing list, marking a significant security update for the web server software.

The National Vulnerability Database assigned a CVSS score of 9.1, classifying the severity as Critical. The weakness stems from a missing validation step in the JNDI realm component. When administrators configure the realm with a non-GSSAPI SASL authentication mechanism, the system fails to verify credentials properly. This effectively opens the door for unauthorized access to any application relying on this specific authentication setup.

Configuration Context and Risk

This issue affects only environments where the JNDI realm is actively used with compatible SASL mechanisms that are not GSSAPI. If an organization uses standard database realms or other authentication methods, this specific flaw does not apply. However, many enterprise environments utilize JNDI for directory services integration, making this a widespread concern for security teams managing legacy or complex infrastructure.

As Threat Times reported on October 20, Apache Tomcat recently addressed other critical flaws, including CVE-2026-101356, which caused HTTP/2 data leakage. Administrators must ensure their systems are updated to the latest patched versions to address both the new authentication bypass and the previously disclosed data exposure risks. The cumulative effect of these updates underscores the importance of maintaining current software versions.

Affected Versions and Support Status

The vulnerability impacts a broad range of Apache Tomcat releases. Active support branches include versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122. Users of these versions should apply the respective patches immediately to mitigate the risk of unauthorized access to their web applications.

Older, end-of-life branches are also affected. Specifically, versions 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 contain this flaw. Although these versions are no longer officially supported, many organizations continue to run them in production. The advisory notes that other unsupported versions may also be vulnerable, suggesting a thorough audit of all Tomcat instances is necessary.

What should you do?

Administrators should verify if their Tomcat instances use JNDI realms with non-GSSAPI SASL mechanisms. If so, upgrade to the patched versions listed in the advisory. Security teams should review authentication logs for suspicious login attempts that may indicate exploitation. Organizations running unsupported versions should prioritize migrating to a supported release to receive future security fixes.