{"id":"CVE-2026-55955","kind":"vulnerability","aliases":["CVE-2026-55955","GHSA-c5ph-rghf-fjfj"],"related":[],"title":"Apache Tomcat has an Improper Authentication vulnerability","description":"Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.118, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.","summary":"Apache Tomcat's cluster EncryptionInterceptor can be abused in a replay attack because of an authentication flaw. An attacker who can capture and resend cluster traffic can get past the intended protection.","severity":"medium","cvss":6.5,"epss":0.00436,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.tomcat:tomcat","fixed":["11.0.23"],"affected":">= 11.0.0-M1, < 11.0.23","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["10.1.56"],"affected":">= 10.1.0-M1, < 10.1.56","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["9.0.119"],"affected":">= 9.0.13, < 9.0.119","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":[],"affected":">= 8.5.38, <= 8.5.100","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":[],"affected":">= 7.0.100, <= 7.0.109","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-tribes","fixed":["11.0.23"],"affected":">= 11.0.0-M1, < 11.0.23","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-tribes","fixed":["10.1.56"],"affected":">= 10.1.0-M1, < 10.1.56","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-tribes","fixed":["9.0.119"],"affected":">= 9.0.13, < 9.0.119","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-tribes","fixed":[],"affected":">= 8.5.38, <= 8.5.100","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-tribes","fixed":[],"affected":">= 7.0.100, <= 7.0.109","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["apache-tomcat","clustering","cwe-287","java","runtime"],"not_affected_if":["no-cluster-encryption-interceptor","standalone-tomcat"],"how_to_check":"- Run `grep -ri EncryptionInterceptor $CATALINA_BASE/conf` to see whether clustering with the encryption interceptor is configured.\n- Check the deployed Tomcat version against the fixed releases listed in the fix section, e.g. `catalina.sh version`.","fix":"- Apache Tomcat 11.x: upgrade to `11.0.23`\n- Apache Tomcat 10.1.x: upgrade to `10.1.56`\n- Apache Tomcat 9.0.x: upgrade to `9.0.119`\n- Apache Tomcat 8.5.x and 7.0.x: unknown (no fixed version stated in the sources)","status":"open","published_at":"2026-06-29T21:32:15+00:00","first_seen_at":"2026-11-04T16:39:44+00:00","triaged_at":"2026-11-04T16:40:58+00:00","updated_at":"2026-11-04T16:40:58+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-04T16:40:58Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Tomcat 11.x: upgrade to `11.0.23`\n- Apache Tomcat 10.1.x: upgrade to `10.1.56`\n- Apache Tomcat 9.0.x: upgrade to `9.0.119`\n- Apache Tomcat 8.5.x and 7.0.x: unknown (no fixed version stated in the sources)","reach":"network","title":"Apache Tomcat: cluster replay attack bypasses EncryptionInterceptor protection","impact":"medium","summary":"Apache Tomcat's cluster EncryptionInterceptor can be abused in a replay attack because of an authentication flaw. An attacker who can capture and resend cluster traffic can get past the intended protection.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-tomcat","java","clustering"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker replays captured cluster messages to bypass authentication","analyst_note":"Confirm whether 8.5.x and 7.0.x receive a fix and what the replay precondition requires, via https://github.com/advisories/GHSA-c5ph-rghf-fjfj","how_to_check":"- Run `grep -ri EncryptionInterceptor $CATALINA_BASE/conf` to see whether clustering with the encryption interceptor is configured.\n- Check the deployed Tomcat version against the fixed releases listed in the fix section, e.g. `catalina.sh version`.","plain_action":"","needs_analyst":true,"not_affected_if":["standalone-tomcat","no-cluster-encryption-interceptor"],"who_is_affected":"Only deployments that run Tomcat in a cluster and use the EncryptionInterceptor in the cluster component are exposed. Standalone Tomcat servers that do not cluster can skip this issue. Versions 8.5.x and 7.0.x have no fixed release in the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000836,"input_tokens":4748,"output_tokens":722,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':9A,17A '-287':54B '-55955':10A,18A '10.1.0':117C '10.1.55':120C '10.1.56':141C '11.0.0':112C '11.0.22':115C '11.0.23':140C '7.0.100':130C '7.0.109':132C '8.5.100':128C '8.5.38':126C '9.0.118':124C '9.0.119':142C '9.0.13':122C 'abus':64B 'affect':108C 'allow':95C 'apach':1A,50B,57B,93C,109C 'apache-tomcat':49B 'attack':68B,75B,98C 'authent':6A,72B,90C 'c5ph':13A 'captur':78B 'cluster':52B,60B,81B,104C 'compon':105C 'cve':8A,16A 'cwe':53B 'encryptioninterceptor':61B,101C 'fix':144C 'fjfj':15A 'flaw':73B 'get':84B 'ghsa':12A 'ghsa-c5ph-rghf-fjfj':11A 'improp':5A,89C 'intend':87B 'issu':107C,146C 'java':55B 'm1':113C,118C 'org.apache.tomcat':19A,21A,23A,25A,27A,29A,33A,37A,41A,45A 'past':85B 'protect':88B 'recommend':135C 'replay':67B,97C 'resend':80B 'rghf':14A 'runtim':56B 'tomcat':2A,20A,22A,24A,26A,28A,31A,35A,39A,43A,47A,51B,58B,94C,110C 'tomcat-tribes':30A,34A,38A,42A,46A 'traffic':82B 'tribes':32A,36A,40A,44A,48A 'upgrad':137C 'user':133C 'version':139C 'vulner':7A,91C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that run Tomcat in a cluster and use the EncryptionInterceptor in the cluster component are exposed. Standalone Tomcat servers that do not cluster can skip this issue. Versions 8.5.x and 7.0.x have no fixed release in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["orgapachetomcattomcat","orgapachetomcattomcattribes"],"ptokens":["apache","org","tomcat","tribes"],"labels":["apachetomcat","clustering","cwe287","java","maven","medium","runtime"],"campaign_type":null,"first_public_at":"2026-06-29T21:32:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-c5ph-rghf-fjfj","url":"https://github.com/advisories/GHSA-c5ph-rghf-fjfj","severity":"medium","published_at":"2026-06-29T21:32:15+00:00","modified_at":"2026-11-04T16:36:58+00:00","first_seen_at":"2026-11-04T16:39:44+00:00","fetched_at":"2026-11-04T16:44:44+00:00","note":null}],"documents":[{"id":68548,"url":"https://github.com/apache/tomcat/commit/3a9ff01d2dfaca651edacbda3260e37b98b540d3","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68549,"url":"https://github.com/apache/tomcat/commit/5e594400c7f6ac0eaf2526bd64442a70f5ccaace","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68550,"url":"https://github.com/apache/tomcat/commit/6a7a432cd7fb4ef358dc12e8da99cf3ab320f3fe","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}