Apache Tomcat leaks passwords and tokens

Published July 30, 2026 CVE-2026-34486

Apache Tomcat servers running in a cluster can silently send session data between servers unencrypted, even when admins turned on encryption for that traffic. Anyone who can watch the network between cluster nodes could read data such as login session details in plain text.

Severity
HighCVSS 3.1 · 7.5
Fix
Fixed in 11.0.21
Affected versions
11.0.20; 10.1.53; 9.0.116
Weakness
CWE-311Missing Encryption of Sensitive Data
Exploit likelihood
99% in 30 daysEPSS, higher than 100% of known flaws
Affects
Apache Tomcat
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 4, 2026
Federal fix deadline
Aug 7, 2026

How it works

A prior fix for a different flaw (CVE-2026-29146) changed how Tomcat's cluster encryption feature works, and that change let the EncryptInterceptor be bypassed, so cluster messages go out unencrypted even though encryption is configured.

What to do

Check your Tomcat version and confirm whether your server.xml Cluster configuration uses the EncryptInterceptor for session replication. Only clustered deployments using that feature are exposed.

Upgrade to Tomcat 11.0.21, 10.1.54, or 9.0.117, which restore working encryption for cluster traffic, and get these from the official Apache Tomcat downloads page.

Technical details

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source