{"id":"CVE-2026-101296","kind":"vulnerability","aliases":["CVE-2026-101296"],"related":[],"title":"Apache Tomcat: JNDI realm with non-GSSAPI SASL lets attackers skip password check","description":"A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","summary":"When Tomcat's JNDI realm uses a SASL mechanism other than GSSAPI, the authentication step can be skipped. An attacker can log in without the correct password.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apache Tomcat 11","fixed":["11.0.27"],"affected":">= 11.0.0-M1, <= 11.0.26","ecosystem":"maven"},{"name":"Apache Tomcat 10.1","fixed":["10.1.61"],"affected":">= 10.1.0-M1, <= 10.1.60","ecosystem":"maven"},{"name":"Apache Tomcat 9","fixed":["9.0.123"],"affected":">= 9.0.0.M1, <= 9.0.122","ecosystem":"maven"},{"name":"Apache Tomcat 8.5","fixed":[],"affected":">= 8.5.0, <= 8.5.100 (EOL)","ecosystem":"maven"}],"ecosystems":[],"tags":["java","jndi-realm","runtime","self-hosted","tomcat"],"not_affected_if":["gssapi-only","managed-hosting","no-jndi-realm"],"how_to_check":"Only affects apps that authenticate through a JNDIRealm using a non-GSSAPI SASL mechanism. Grep conf/server.xml and conf/context.xml for <Realm className=\"org.apache.catalina.realm.JNDIRealm\" and check whether a SASL authentication mechanism is set (e.g. DIGEST-MD5, EXTERNAL). Run catalina.sh version (or bin/version.bat) and compare with the affected ranges.","fix":"Upgrade to Tomcat 11.0.27, 10.1.61 or 9.0.123. 8.5.x and 7.0.x are EOL and affected with no fix, so migrate. Until upgraded, stop using the JNDIRealm with non-GSSAPI SASL, or use GSSAPI or plain bind authentication.","status":"resolved","published_at":"2026-10-20T14:16:54+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:31+00:00","updated_at":"2026-10-23T23:20:30+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T22:39:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Tomcat to 11.0.27, 10.1.61 or 9.0.123. Versions 8.5.x and 7.0.x are EOL and affected, so move off them.","reach":"network","title":"Apache Tomcat: JNDI realm with non-GSSAPI SASL lets attackers skip password check","impact":"high","summary":"When Tomcat's JNDI realm uses a SASL mechanism other than GSSAPI, the authentication step can be skipped. An attacker can log in without the correct password.","category":"runtime","who_cares":["tomcat","java","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"attacker logs in as any user the JNDI realm protects","analyst_note":"Confirm the affected SASL mechanism config and which Tomcat versions the advisory lists as fixed; check the NVD link and Apache Tomcat security pages for a how-to-check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-jndi-realm","gssapi-only"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000511,"input_tokens":3087,"output_tokens":405,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected SASL mechanism config and which Tomcat versions the advisory lists as fixed; check the NVD link and Apache Tomcat security pages for a how-to-check.","search":"'-101296':17A,20A '-2026':16A,19A '10.1':26A '10.1.0':113C '10.1.60':116C '10.1.61':163C '11':23A '11.0.0':108C '11.0.26':111C '11.0.27':162C '7.0.0':145C '7.0.109':147C '8.5':32A '8.5.0':141C '8.5.100':143C '9':29A '9.0.0':118C '9.0.122':121C '9.0.123':165C 'affect':104C,139C,154C 'allow':93C 'also':152C 'apach':1A,77C,105C 'apache':21A,24A,27A,30A 'attack':11A,61B,94C 'authent':55B,74C,91C,96C 'check':14A 'configur':84C 'correct':67B,100C 'creat':133C 'critic':71C 'cve':15A,18A,131C 'eol':126C 'fix':167C 'follow':123C 'gssapi':8A,53B,89C 'host':40B 'issu':103C,169C 'java':33B 'jndi':3A,35B,45B,81C 'jndi-realm':34B 'known':136C 'let':10A 'log':63B 'm1':109C,114C,119C 'may':151C 'mechan':50B,92C 'miss':70C 'non':7A,88C 'non-gssapi':6A 'password':13A,68B,101C 'provid':98C 'realm':4A,36B,46B,82C 'recommend':157C 'runtim':37B 'sasl':9A,49B,90C 'self':39B 'self-host':38B 'skip':12A,59B 'step':56B,72C 'time':129C 'tomcat':2A,22A,25A,28A,31A,41B,43B,78C,106C 'unsupport':149C 'upgrad':159C 'use':47B 'user':155C 'version':124C,150C,161C 'vulner':75C 'without':65B,97C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T14:16:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101296","severity":null,"published_at":"2026-10-20T14:16:54+00:00","modified_at":"2026-10-21T04:16:58+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101296:420","url":null,"severity":null,"published_at":"2026-10-23T23:20:30+00:00","modified_at":"2026-10-23T23:20:30+00:00","first_seen_at":"2026-10-23T23:20:30+00:00","fetched_at":"2026-10-23T23:20:30+00:00","note":"Read Tomcat 11 security page (Apache rates it Important; fix commit e43453fc; reported 14 Sep, public 20 Oct 2026) plus NVD text. Social search not run. 10.1/9 pages not read; their versions come from the NVD text. No exploitation or PoC found."}],"documents":[{"id":1891,"url":"https://tomcat.apache.org/security-11.html","title":"Apache Tomcat 11.x vulnerabilities (CVE-2026-101296, fixed in 11.0.27)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1898,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101296","title":"NVD CVE-2026-101296","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}