---
id: "CVE-2026-55955"
kind: "vulnerability"
aliases: ["CVE-2026-55955", "GHSA-c5ph-rghf-fjfj"]
title: "Apache Tomcat has an Improper Authentication vulnerability"
severity: "medium"
cvss: 6.5
epss: 0.00436
exploited: false
status: "open"
category: "runtime"
products: [{"name": "org.apache.tomcat:tomcat", "fixed": ["11.0.23"], "affected": ">= 11.0.0-M1, < 11.0.23", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["10.1.56"], "affected": ">= 10.1.0-M1, < 10.1.56", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["9.0.119"], "affected": ">= 9.0.13, < 9.0.119", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": [], "affected": ">= 8.5.38, <= 8.5.100", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": [], "affected": ">= 7.0.100, <= 7.0.109", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-tribes", "fixed": ["11.0.23"], "affected": ">= 11.0.0-M1, < 11.0.23", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-tribes", "fixed": ["10.1.56"], "affected": ">= 10.1.0-M1, < 10.1.56", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-tribes", "fixed": ["9.0.119"], "affected": ">= 9.0.13, < 9.0.119", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-tribes", "fixed": [], "affected": ">= 8.5.38, <= 8.5.100", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-tribes", "fixed": [], "affected": ">= 7.0.100, <= 7.0.109", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["apache-tomcat", "clustering", "cwe-287", "java", "runtime"]
not_affected_if: ["no-cluster-encryption-interceptor", "standalone-tomcat"]
published_at: "2026-06-29T21:32:15+00:00"
first_seen_at: "2026-11-04T16:39:44+00:00"
updated_at: "2026-11-04T16:40:58+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-c5ph-rghf-fjfj", "first_seen_at": "2026-11-04T16:39:44+00:00"}]
---

# Apache Tomcat has an Improper Authentication vulnerability

Apache Tomcat's cluster EncryptionInterceptor can be abused in a replay attack because of an authentication flaw. An attacker who can capture and resend cluster traffic can get past the intended protection.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.tomcat:tomcat affected >= 11.0.0-M1, < 11.0.23 fixed 11.0.23
- maven:org.apache.tomcat:tomcat affected >= 10.1.0-M1, < 10.1.56 fixed 10.1.56
- maven:org.apache.tomcat:tomcat affected >= 9.0.13, < 9.0.119 fixed 9.0.119
- maven:org.apache.tomcat:tomcat affected >= 8.5.38, <= 8.5.100 fixed ?
- maven:org.apache.tomcat:tomcat affected >= 7.0.100, <= 7.0.109 fixed ?
- maven:org.apache.tomcat:tomcat-tribes affected >= 11.0.0-M1, < 11.0.23 fixed 11.0.23
- maven:org.apache.tomcat:tomcat-tribes affected >= 10.1.0-M1, < 10.1.56 fixed 10.1.56
- maven:org.apache.tomcat:tomcat-tribes affected >= 9.0.13, < 9.0.119 fixed 9.0.119
- maven:org.apache.tomcat:tomcat-tribes affected >= 8.5.38, <= 8.5.100 fixed ?
- maven:org.apache.tomcat:tomcat-tribes affected >= 7.0.100, <= 7.0.109 fixed ?

## How to check

- Run `grep -ri EncryptionInterceptor $CATALINA_BASE/conf` to see whether clustering with the encryption interceptor is configured.
- Check the deployed Tomcat version against the fixed releases listed in the fix section, e.g. `catalina.sh version`.

## Fix

- Apache Tomcat 11.x: upgrade to `11.0.23`
- Apache Tomcat 10.1.x: upgrade to `10.1.56`
- Apache Tomcat 9.0.x: upgrade to `9.0.119`
- Apache Tomcat 8.5.x and 7.0.x: unknown (no fixed version stated in the sources)

## Timeline

- 2026-11-04T16:39:44+00:00 ghsa https://github.com/advisories/GHSA-c5ph-rghf-fjfj

## Documents

- [fix] Patch: github.com https://github.com/apache/tomcat/commit/3a9ff01d2dfaca651edacbda3260e37b98b540d3
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/5e594400c7f6ac0eaf2526bd64442a70f5ccaace
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/6a7a432cd7fb4ef358dc12e8da99cf3ab320f3fe

## From the sources

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.118, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_