--- id: "CVE-2026-34486" kind: "vulnerability" aliases: ["CVE-2026-34486"] title: "Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the\u2026" severity: "high" cvss: 7.5 epss: null exploited: true status: "open" category: "runtime" products: [{"name": "Apache Tomcat", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Apache Tomcat 11", "fixed": ["11.0.21"], "affected": "11.0.20", "ecosystem": "vendor"}, {"name": "Apache Tomcat 10.1", "fixed": ["10.1.54"], "affected": "10.1.53", "ecosystem": "vendor"}, {"name": "Apache Tomcat 9", "fixed": ["9.0.117"], "affected": "9.0.116", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": [], "affected": "= 9.0.116", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": [], "affected": "= 10.1.53", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": [], "affected": "= 11.0.20", "ecosystem": "vendor"}, {"name": "redhat jboss web server", "fixed": [], "affected": "= 7.0.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux els", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 10.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux tus", "fixed": [], "affected": "= 8.8", "ecosystem": "vendor"}, {"name": "redhat enterprise linux update services for sap solutions", "fixed": [], "affected": "= 8.8", "ecosystem": "vendor"}, {"name": "redhat enterprise linux update services for sap solutions", "fixed": [], "affected": "= 9.2", "ecosystem": "vendor"}, {"name": "redhat enterprise linux update services for sap solutions", "fixed": [], "affected": "= 9.4", "ecosystem": "vendor"}, {"name": "redhat enterprise linux update services for sap solutions", "fixed": [], "affected": "= 9.6", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["clustered-deployments", "exploited", "java", "runtime", "tomcat"] not_affected_if: ["no-clustering", "no-encryptinterceptor", "other-tomcat-versions"] published_at: "2026-04-09T20:16:25+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T23:44:51+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-34486", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:42:27+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34486", "first_seen_at": "2026-10-23T23:44:51+00:00"}] --- # Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the… The fix for CVE-2026-29146 in Tomcat 11.0.20, 10.1.53 and 9.0.116 contained an error that lets the EncryptInterceptor be bypassed. Cluster (Tribes) traffic between nodes can then go unencrypted. Apache rates it Important and CVSS is 7.5. Only those three exact releases are affected; earlier and later releases are not. Reported exploited in the wild. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Apache Tomcat affected ? fixed ? - vendor:Apache Tomcat 11 affected 11.0.20 fixed 11.0.21 - vendor:Apache Tomcat 10.1 affected 10.1.53 fixed 10.1.54 - vendor:Apache Tomcat 9 affected 9.0.116 fixed 9.0.117 - vendor:apache tomcat affected = 9.0.116 fixed ? - vendor:apache tomcat affected = 10.1.53 fixed ? - vendor:apache tomcat affected = 11.0.20 fixed ? - vendor:redhat jboss web server affected = 7.0.0 fixed ? - vendor:redhat enterprise linux affected = 8.0 fixed ? - vendor:redhat enterprise linux affected = 9.0 fixed ? - vendor:redhat enterprise linux affected = 10.0 fixed ? - vendor:redhat enterprise linux els affected = 7.0 fixed ? - vendor:redhat enterprise linux eus affected = 10.0 fixed ? - vendor:redhat enterprise linux tus affected = 8.8 fixed ? - vendor:redhat enterprise linux update services for sap solutions affected = 8.8 fixed ? - vendor:redhat enterprise linux update services for sap solutions affected = 9.2 fixed ? - vendor:redhat enterprise linux update services for sap solutions affected = 9.4 fixed ? - vendor:redhat enterprise linux update services for sap solutions affected = 9.6 fixed ? ## How to check Run catalina.sh version (or version.bat) on each node and look for exactly 11.0.20, 10.1.53 or 9.0.116. Then check whether server.xml has with . If no clustering is configured, there is no exposure. ## Fix Upgrade to Tomcat 11.0.21 or later, 10.1.54 or later, or 9.0.117 or later. Afterwards review the EncryptInterceptor setup against Tomcat's later advisories (CVE-2026-55955 replay protection, CVE-2026-59084 documentation fix in 11.0.24). ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-34486 - 2026-10-23T21:42:27+00:00 analyst — Apache announce (Mark Thomas, 2026-04-09) plus GHSA and CVE record: only 11.0.20, 10.1.53, 9.0.116 are affected; fixed in 11.0.21, 10.1.54, 9.0.117. Exploitation rests on CISA KEV (triage) and CSA Singapore. No public PoC found. The CVE-2025-24813 chaining claim is not in the primary sources and I did not verify it. No social search done. - 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-34486 ## Documents - [advisory] Apache Tomcat announce: CVE-2026-34486 https://www.mail-archive.com/announce@tomcat.apache.org/msg00771.html - [describes] GHSA-69r9-qgr7-g2wj CVE-2026-34486 https://github.com/advisories/GHSA-69r9-qgr7-g2wj - [mentions] CSA Singapore AL-2026-102: exploitation reported https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-102/ ## From the sources Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_