{"id":"CVE-2026-34486","kind":"vulnerability","aliases":["CVE-2026-34486"],"related":[],"title":"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the…","description":"Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"The fix for CVE-2026-29146 in Tomcat 11.0.20, 10.1.53 and 9.0.116 contained an error that lets the EncryptInterceptor be bypassed. Cluster (Tribes) traffic between nodes can then go unencrypted. Apache rates it Important and CVSS is 7.5. Only those three exact releases are affected; earlier and later releases are not. Reported exploited in the wild.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2026-08-04T00:00:00+00:00","products":[{"name":"Apache Tomcat","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Apache Tomcat 11","fixed":["11.0.21"],"affected":"11.0.20","ecosystem":"vendor"},{"name":"Apache Tomcat 10.1","fixed":["10.1.54"],"affected":"10.1.53","ecosystem":"vendor"},{"name":"Apache Tomcat 9","fixed":["9.0.117"],"affected":"9.0.116","ecosystem":"vendor"},{"name":"apache tomcat","fixed":[],"affected":"= 9.0.116","ecosystem":"vendor"},{"name":"apache tomcat","fixed":[],"affected":"= 10.1.53","ecosystem":"vendor"},{"name":"apache tomcat","fixed":[],"affected":"= 11.0.20","ecosystem":"vendor"},{"name":"redhat jboss web server","fixed":[],"affected":"= 7.0.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 8.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"redhat enterprise linux els","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 10.0","ecosystem":"vendor"},{"name":"redhat enterprise linux tus","fixed":[],"affected":"= 8.8","ecosystem":"vendor"},{"name":"redhat enterprise linux update services for sap solutions","fixed":[],"affected":"= 8.8","ecosystem":"vendor"},{"name":"redhat enterprise linux update services for sap solutions","fixed":[],"affected":"= 9.2","ecosystem":"vendor"},{"name":"redhat enterprise linux update services for sap solutions","fixed":[],"affected":"= 9.4","ecosystem":"vendor"},{"name":"redhat enterprise linux update services for sap solutions","fixed":[],"affected":"= 9.6","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["clustered-deployments","exploited","java","runtime","tomcat"],"not_affected_if":["no-clustering","no-encryptinterceptor","other-tomcat-versions"],"how_to_check":"Run catalina.sh version (or version.bat) on each node and look for exactly 11.0.20, 10.1.53 or 9.0.116. Then check whether server.xml has <Cluster> with <Interceptor className=\"org.apache.catalina.tribes.group.interceptors.EncryptInterceptor\">. If no clustering is configured, there is no exposure.","fix":"Upgrade to Tomcat 11.0.21 or later, 10.1.54 or later, or 9.0.117 or later. Afterwards review the EncryptInterceptor setup against Tomcat's later advisories (CVE-2026-55955 replay protection, CVE-2026-59084 documentation fix in 11.0.24).","status":"open","published_at":"2026-04-09T20:16:25+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:32:02+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T20:32:02Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation from Apache Tomcat and follow CISA BOD 26-04 guidance; the specific fixed version is unknown from the sources.\nIf mitigations are unavailable, discontinue use of the affected Tomcat deployment per CISA guidance.","summary":"Apache Tomcat has a missing encryption of sensitive data flaw that lets an attacker bypass the EncryptInterceptor clustering protection, so data meant to be encrypted between cluster nodes can be exposed. It can be chained with CVE-2025-24813, and CISA lists it as actively exploited.","category":"runtime","who_cares":["tomcat","java","clustered-deployments"],"confidence":0.6,"analyst_note":"Find affected and fixed Tomcat versions and the EncryptInterceptor configuration check at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-34486 and the Apache Tomcat security pages.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-clustering","no-encryptinterceptor"],"severity_if_unknown":"high"},"cost_usd":0.000427,"input_tokens":2215,"output_tokens":410,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find affected and fixed Tomcat versions and the EncryptInterceptor configuration check at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-34486 and the Apache Tomcat security pages.","search":"'-04':205C,231C,262C '-2026':16A,20A,23A,110B '-29146':17A,111B '-34486':21A,24A '10.1':32A '10.1.53':115B '11':29A '11.0.20':114B '2025':186C '24813':187C '26':204C,230C,261C '7.5':143B '9':35A '9.0.116':117B 'accord':194C 'action':190C 'adher':258C 'affect':150B 'allow':18A,173C 'apach':8A,136B,162C 'apache':25A,27A,30A,33A,36A,38A,40A 'appli':191C 'applic':228C 'asset':252C 'base':209C 'bod':203C,229C,260C 'bypass':126B,175C 'chain':183C 'cisa':188C,201C,218C 'cloud':234C 'cluster':100B,127B 'clustered-deploy':99B 'complianc':199C 'contain':118B,164C 'cve':15A,19A,22A,109B,185C 'cvss':141B 'data':5A,170C 'deploy':101B 'discontinu':237C 'due':10A 'earlier':151B 'els':58A 'encrypt':2A,167C 'encryptinterceptor':124B,178C 'ensur':198C,257C 'enterprise':47A,50A,53A,56A,60A,64A,68A,76A,84A,92A 'error':120B 'eus':62A 'evalu':250C 'exact':147B 'exploit':102B,158B 'exposur':255C 'fix':13A,107B 'follow':227C 'for':72A,80A,88A,96A 'forens':220C 'go':134B 'guidanc':216C,232C 'guidelin':264C 'import':139B 'instruct':197C 'internet':254C 'java':103B 'jboss':43A 'later':153B 'let':122B 'linux':48A,51A,54A,57A,61A,65A,69A,77A,85A,93A 'miss':1A,166C 'mitig':192C,243C 'node':131B 'note':215C,226C 'patch':263C 'priorit':206C 'product':241C 'rate':137B 'redhat':42A,46A,49A,52A,55A,59A,63A,67A,75A,83A,91A 'releas':148B,154B 'report':157B 'requir':189C,222C 'respons':248C 'risk':211C 'runtim':104B 'sap':73A,81A,89A,97A 'secur':207C 'see':212C,223C 'sensit':4A,169C 'server':45A 'servic':235C 'services':71A,79A,87A,95A 'solutions':74A,82A,90A,98A 'stakehold':246C 'three':146B 'tomcat':9A,26A,28A,31A,34A,37A,39A,41A,105B,113B,163C 'traffic':129B 'triag':221C 'tribe':128B 'tus':66A 'unavail':245C 'unencrypt':135B 'updat':208C 'update':70A,78A,86A,94A 'url':213C,224C 'use':238C 'vendor':196C 'vulner':6A,171C,180C 'web':44A 'wild':161B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-04-09T20:16:25+00:00","kev":{"dateAdded":"2026-08-04","dueDate":"2026-08-07","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-34486","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-34486","severity":null,"published_at":"2026-08-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-34486:134","url":null,"severity":null,"published_at":"2026-10-23T21:42:27+00:00","modified_at":"2026-10-23T21:42:27+00:00","first_seen_at":"2026-10-23T21:42:27+00:00","fetched_at":"2026-10-23T21:42:27+00:00","note":"Apache announce (Mark Thomas, 2026-04-09) plus GHSA and CVE record: only 11.0.20, 10.1.53, 9.0.116 are affected; fixed in 11.0.21, 10.1.54, 9.0.117. Exploitation rests on CISA KEV (triage) and CSA Singapore. No public PoC found. The CVE-2025-24813 chaining claim is not in the primary sources and I did not verify it. No social search done."},{"source":"nvd","external_id":"CVE-2026-34486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34486","severity":null,"published_at":"2026-04-09T20:16:25+00:00","modified_at":"2026-09-21T19:17:04+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[{"id":1210,"url":"https://www.mail-archive.com/announce@tomcat.apache.org/msg00771.html","title":"Apache Tomcat announce: CVE-2026-34486","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1211,"url":"https://github.com/advisories/GHSA-69r9-qgr7-g2wj","title":"GHSA-69r9-qgr7-g2wj CVE-2026-34486","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1212,"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-102/","title":"CSA Singapore AL-2026-102: exploitation reported","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}