CVE-2026-34486

Published Apr 9, 2026

Last updated 8 days ago

Exploit known CVSS high 7.5

Apache Tomcat

web application

Zero-day

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-34486 is a vulnerability found in Apache Tomcat Tribes, specifically within the `EncryptInterceptor` component responsible for decrypting cluster messages. This issue stems from a regression introduced during a fix for a prior vulnerability, CVE-2026-29146. The regression causes decryption failures to "fail open" rather than "fail closed," meaning that when decryption fails, the original unencrypted or malformed message is still forwarded for processing, bypassing the intended encryption protection. This bypass allows attacker-supplied bytes to reach Tomcat's Java deserialization code path, which utilizes `ObjectInputStream.readObject()` without an `ObjectInputFilter` in the affected flow. Consequently, untrusted serialized objects can be loaded and instantiated. The vulnerability is also described as a "Missing Encryption of Sensitive Data" flaw, enabling the bypass of the `EncryptInterceptor` and potentially exposing sensitive data that should have been encrypted.

Description: Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
Source: security@apache.org
NVD status: Analyzed
Products: tomcat, jboss_web_server, enterprise_linux, enterprise_linux_els, enterprise_linux_eus, enterprise_linux_tus, enterprise_linux_update_services_for_sap_solutions

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
Exploit added on: Aug 4, 2026
Exploit action due: Aug 7, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

security@apache.org: CWE-311
0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-807

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apache:tomcat:9.0.116:*:*:*:*:*:*:*",
            "matchCriteriaId": "CC160F23-A9D6-42DA-92E6-886B1B1F48A6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:10.1.53:*:*:*:*:*:*:*",
            "matchCriteriaId": "0E7A0CE9-EBDF-4305-9C06-E7D4521AF422",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:apache:tomcat:11.0.20:*:*:*:*:*:*:*",
            "matchCriteriaId": "64BAAE4D-2355-43D8-83E5-01CA71D5DC0B",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:redhat:jboss_web_server:7.0.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "F764C52A-4533-4C39-A5A2-A5E1FE20960C",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_els:7.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "0460F769-D90A-4446-AC00-24F66BDBF526",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "34990D09-125F-48CA-B85E-9D9F0EB4BC07",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*",
            "matchCriteriaId": "22D28543-C7C5-46B0-B909-20435AF7A501",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*",
            "matchCriteriaId": "01ED4F33-EBE7-4C04-8312-3DA580EFFB68",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*",
            "matchCriteriaId": "1FD9BF0E-7ACF-4A83-B754-6E3979ED903F",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.4:*:*:*:*:*:*:*",
            "matchCriteriaId": "18B7F648-9A31-4EE5-A215-C860616A4AB7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.6:*:*:*:*:*:*:*",
            "matchCriteriaId": "554AA8CA-A930-4788-B052-497E09D48381",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.