{"id":"CVE-2026-111248","kind":"vulnerability","aliases":["CVE-2026-111248"],"related":[],"title":"Apache Tomcat: stored password digests accepted as passwords in Jakarta Security","description":"The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users file or backup, can authenticate with the digest instead of the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"Tomcat's Jakarta Security identity store, when backed by the Tomcat user database, compares logins as plain text and skips the configured credential handler. An attacker who obtains a stored password digest, such as from a leaked users file or backup, can log in with that digest instead of the real password.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jakarta-ee","java","runtime","self-hosted","tomcat"],"not_affected_if":["no-jakarta-security","other-identity-store","plain-text-passwords"],"how_to_check":"- Check the Tomcat version with `catalina.sh version` and compare it to the fixed versions below.\n- Look for a Jakarta Security identity store backed by the Tomcat user database and digested passwords in the users configuration.","fix":"- Upgrade Apache Tomcat 10.x to `10.3.0`.\n- Upgrade Apache Tomcat 11.x to `11.0.0-M2`.","status":"open","published_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","triaged_at":"2026-11-10T16:24:14+00:00","updated_at":"2026-11-10T16:24:14+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-10T16:24:14Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Tomcat 10.x to `10.3.0`.\n- Upgrade Apache Tomcat 11.x to `11.0.0-M2`.","reach":"network","title":"Apache Tomcat: stored password digests accepted as passwords in Jakarta Security","impact":"high","summary":"Tomcat's Jakarta Security identity store, when backed by the Tomcat user database, compares logins as plain text and skips the configured credential handler. An attacker who obtains a stored password digest, such as from a leaked users file or backup, can log in with that digest instead of the real password.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["tomcat","java","jakarta-ee","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker logs in as a user using a stolen password digest","analyst_note":"ņ","how_to_check":"- Check the Tomcat version with `catalina.sh version` and compare it to the fixed versions below.\n- Look for a Jakarta Security identity store backed by the Tomcat user database and digested passwords in the users configuration.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["other-identity-store","plain-text-passwords","no-jakarta-security"],"who_is_affected":"Applications running on Apache Tomcat that use Jakarta Security with the Tomcat user database as the identity store, and store passwords as digests. Deployments using other identity stores, plain-text passwords, or no Jakarta Security integration are not exposed by this description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4580,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111248':14A,17A '-2026':13A,16A '10.3.0':144C '11.0.0':146C 'accept':6A 'apach':1A 'attack':52B,113C 'authent':129C 'back':34B,84C 'backup':67B,127C 'compar':40B,90C 'configur':48B,104C 'credenti':49B,105C 'cve':12A,15A 'databas':39B,89C 'digest':5A,58B,73B,108C,118C,132C 'ee':20B 'exampl':120C 'file':65B,125C 'fix':149C 'handler':50B,106C 'host':25B 'ident':31B,82C 'ignor':102C 'instead':74B,133C 'issu':151C 'jakarta':10A,19B,29B,80C 'jakarta-e':18B 'java':21B 'leak':63B,123C 'log':69B 'login':41B 'm2':147C 'obtain':54B,115C 'password':4A,8A,57B,78B,93C,109C,136C 'plain':43B,99C 'real':77B 'recommend':139C 'runtim':22B 'secur':11A,30B,81C 'self':24B 'self-host':23B 'skip':46B 'store':3A,32B,56B,83C,96C,111C,117C 'suppli':92C 'text':44B,100C 'tomcat':2A,26B,27B,37B,87C 'upgrad':141C 'user':38B,64B,88C,124C,137C 'valu':97C 'version':143C","nicknames":[],"mitigations":[],"who_affected":"Applications running on Apache Tomcat that use Jakarta Security with the Tomcat user database as the identity store, and store passwords as digests. Deployments using other identity stores, plain-text passwords, or no Jakarta Security integration are not exposed by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jakartaee","java","medium","runtime","selfhosted","tomcat"],"campaign_type":null,"search_a":"'-111248':14A,17A '-2026':13A,16A 'accept':6A 'apach':1A 'cve':12A,15A 'digest':5A 'jakarta':10A 'password':4A,8A 'secur':11A 'store':3A 'tomcat':2A","search_b":"'attack':52B 'back':34B 'backup':67B 'compar':40B 'configur':48B 'credenti':49B 'databas':39B 'digest':58B,73B 'ee':20B 'file':65B 'handler':50B 'host':25B 'ident':31B 'instead':74B 'jakarta':19B,29B 'jakarta-e':18B 'java':21B 'leak':63B 'log':69B 'login':41B 'obtain':54B 'password':57B,78B 'plain':43B 'real':77B 'runtim':22B 'secur':30B 'self':24B 'self-host':23B 'skip':46B 'store':32B,56B 'text':44B 'tomcat':26B,27B,37B 'user':38B,64B","search_c":"'10.3.0':144C '11.0.0':146C 'attack':113C 'authent':129C 'back':84C 'backup':127C 'compar':90C 'configur':104C 'credenti':105C 'databas':89C 'digest':108C,118C,132C 'exampl':120C 'file':125C 'fix':149C 'handler':106C 'ident':82C 'ignor':102C 'instead':133C 'issu':151C 'jakarta':80C 'leak':123C 'm2':147C 'obtain':115C 'password':93C,109C,136C 'plain':99C 'recommend':139C 'secur':81C 'store':83C,96C,111C,117C 'suppli':92C 'text':100C 'tomcat':87C 'upgrad':141C 'user':88C,124C,137C 'valu':97C 'version':143C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111248","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111248","severity":null,"published_at":"2026-11-10T16:17:15+00:00","modified_at":"2026-11-10T16:17:15+00:00","first_seen_at":"2026-11-10T16:22:33+00:00","fetched_at":"2026-11-10T16:22:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}