The Apache Software Foundation has disclosed two security vulnerabilities in Apache Tomcat that can lead to authentication bypass and improper enforcement of security constraints.
These vulnerabilities impact various deployments across enterprise environments. They are tracked as CVE-2026-55957 (Important severity) and CVE-2026-55956 (Moderate severity) and affect multiple supported versions of Tomcat. If left unpatched, these issues could expose sensitive applications to unauthorized access.
Both vulnerabilities were publicly announced on June 29, 2026, through the official Apache Tomcat security advisories. Given Tomcat’s widespread use as a Java servlet container in production environments, these issues pose significant risks, especially when security constraints are relied upon for access control.
Authentication Bypass via JNDIRealm Misconfiguration
CVE-2026-55957 is the more severe of the two vulnerabilities. It involves an authentication bypass that occurs when JNDIRealm is used in combination with a GSSAPI authenticated bind.
The flaw results from improper handling of security constraints associated with the default servlet. Specifically, when constraints are defined, any HTTP methods or method omissions specified in the constraint are ignored during enforcement.
This situation allows attackers to bypass intended authentication controls by leveraging unvalidated HTTP methods or exploiting inconsistencies in how constraints are applied.
In environments where JNDIRealm is configured for centralized authentication, such as LDAP-backed identity systems, this flaw could allow unauthorized access without valid credentials.
The vulnerability affects Apache Tomcat versions 11.0.0-M1 through 11.0.4, 10.1.0-M1 through 10.1.36, and 9.0.0-M1 through 9.0.100. Older unsupported versions may also be impacted, increasing the risk for legacy deployments. Security researcher Ilan Toyter identified the issue.
Security Constraints Bypass in Default Servlet
CVE-2026-55956, rated as Moderate severity, also arises from improper enforcement of security constraints within the default servlet. Similar to CVE-2026-55957, this flaw causes configured HTTP method restrictions to be ignored when security constraints are applied.
As a result, access control policies that rely on restricting specific HTTP methods (such as GET, POST, PUT, or DELETE) may not function as intended.
This flaw could allow attackers to perform unauthorized actions by issuing requests using methods that should have been restricted. For example, a protected endpoint intended to block POST requests might still accept them, potentially enabling data modification or unintended interactions.
This vulnerability affects a broader range of versions, including Apache Tomcat 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, and 9.0.0-M1 through 9.0.118. The flaw was discovered by researcher j0hndo.
Apache has released patched versions that address both vulnerabilities. Users are strongly advised to upgrade immediately to Tomcat 11.0.5+ for CVE-2026-55957, and to Tomcat 10.1.37+ or 9.0.101+. For CVE-2026-55956, users should upgrade to Tomcat 11.0.23+, 10.1.56+, or 9.0.119+.
Organizations running exposed Tomcat instances, especially those integrated with enterprise authentication systems, should prioritize patching and review their access control configurations.
Security teams are also encouraged to audit logs for unusual HTTP method usage and validate that security constraints behave as expected after remediation.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
