> CVE-2026-55957

« BACK_TO_HOME
PUBLISHED
2026-06-29 21:16
MODIFIED
2026-06-29 21:16
EPSS (Prob. Exploit)
2.86%
Top 13.3%
DATA SOURCES:
NVD 🔗 2026-06-29 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 GITHUB 🔗 2026-11-05 OSV 🔗 2026-11-02

> DESCRIPTION

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-304

> CWE DETAILED DESCRIPTIONS

CWE-304: Missing Critical Step in Authentication - The product implements an authentication technique, but it skips a step that weakens the technique.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: tomcat9 security update
An update for tomcat9 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vul...
Red Hat Security Advisory: tomcat security update
An update for tomcat is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vuln...
Red Hat Security Advisory: tomcat security update
An update for tomcat is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (C...
Red Hat Security Advisory: tomcat security update
An update for tomcat is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Co...
Red Hat Security Advisory: tomcat security update
An update for tomcat is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Co...
Red Hat Security Advisory: tomcat security update
An update for tomcat is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security h...
Red Hat Security Advisory: tomcat security update
An update for tomcat is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulne...

> GITHUB SECURITY ADVISORY

GHSA-7895-gffq-w6jq HIGH

Apache Tomcat has a Missing Critical Step in Authentication vulnerability

AFFECTED PACKAGES:
MAVEN / org.apache.tomcat:tomcat-catalina
<= 7.0.109
MAVEN / org.apache.tomcat:tomcat-catalina
>= 8.5.0, <= 8.5.100
MAVEN / org.apache.tomcat:tomcat-catalina
>= 9.0.0.M1, < 9.0.101
Fixed in: 9.0.101
MAVEN / org.apache.tomcat:tomcat-catalina
>= 10.1.0-M1, < 10.1.37
Fixed in: 10.1.37
MAVEN / org.apache.tomcat:tomcat-catalina
>= 11.0.0-M1, < 11.0.5
Fixed in: 11.0.5
MAVEN / org.apache.tomcat:tomcat
<= 7.0.109
MAVEN / org.apache.tomcat:tomcat
>= 8.5.0, <= 8.5.100
MAVEN / org.apache.tomcat:tomcat
>= 9.0.0.M1, < 9.0.101
Fixed in: 9.0.101
MAVEN / org.apache.tomcat:tomcat
>= 10.1.0-M1, < 10.1.37
Fixed in: 10.1.37
MAVEN / org.apache.tomcat:tomcat
>= 11.0.0-M1, < 11.0.5
Fixed in: 11.0.5

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

AFFECTED PACKAGES:
Unknown / Unknown
ALIASES:
BIT-tomcat-2026-55957

> HISTORIQUE DES MODIFICATIONS

Première apparition
29/06/2026 21:16
Source: NVD
📊 ENRICHISSEMENT 01/07/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-304: Missing Critical Step in Authentication - The product implements an authentication technique, but it skips a step that weakens the technique.
Total des modifications: 1 Dernière mise à jour: 4 months ago

> REFERENCES

https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh
« BACK_TO_HOME