---
id: "CVE-2026-111248"
page: "https://infrastack.ai/live/CVE-2026-111248"
kind: "vulnerability"
aliases: ["CVE-2026-111248"]
title: "Apache Tomcat: stored password digests accepted as passwords in Jakarta Security"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["jakarta-ee", "java", "runtime", "self-hosted", "tomcat"]
not_affected_if: ["no-jakarta-security", "other-identity-store", "plain-text-passwords"]
published_at: "2026-11-10T16:17:15+00:00"
first_seen_at: "2026-11-10T16:22:33+00:00"
updated_at: "2026-11-10T16:24:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111248", "first_seen_at": "2026-11-10T16:22:33+00:00"}]
exploit_sources: []
---

# Apache Tomcat: stored password digests accepted as passwords in Jakarta Security

Link for people: https://infrastack.ai/live/CVE-2026-111248 (this .md is for agents)

Tomcat's Jakarta Security identity store, when backed by the Tomcat user database, compares logins as plain text and skips the configured credential handler. An attacker who obtains a stored password digest, such as from a leaked users file or backup, can log in with that digest instead of the real password.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Tomcat version with `catalina.sh version` and compare it to the fixed versions below.
- Look for a Jakarta Security identity store backed by the Tomcat user database and digested passwords in the users configuration.

## Fix

- Upgrade Apache Tomcat 10.x to `10.3.0`.
- Upgrade Apache Tomcat 11.x to `11.0.0-M2`.

## Timeline

- 2026-11-10T16:22:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111248

## From the sources

The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text and ignores the configured credential handler. When digested passwords are stored, an attacker who obtained a stored digest, for example from a leaked users file or backup, can authenticate with the digest instead of the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_