ORG.APACHE.TOMCAT.EMBED:TOMCAT-EMBED-CORE · CVE-2026-55957 · Package
FIX → 11.0.5 · 10.1.37 · 9.0.101
When Apache Tomcat's JNDIRealm is configured to authenticate binds using GSSAPI, an attacker can log in without knowing the correct password. The flaw is a missing authentication step in that code path.
first public Jun 29, 2026 · 2 sources
Running Org.apache.tomcat.embed:tomcat-embed-core? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only deployments that use Tomcat's JNDIRealm with GSSAPI bind authentication are exposed. Applications that authenticate users some other way, or that do not use JNDIRealm, are not affected by this flaw. The sources do not say whether 8.5.x or 7.0.x have a fix.
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without providing the correct password.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Not affected if no-gssapi-bind, no-jndirealm, other-auth-realm
Who cares apache-tomcat, cwe-304, java, maven, self-hosted
catalina.sh version or the tomcat-embed-core version in your Maven or Gradle dependencies.conf/server.xml or context.xml for a JNDIRealm element that uses GSSAPI bind authentication.Upgrade to 11.0.5 · 10.1.37 · 9.0.101
11.0.510.1.379.0.101Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-55957") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.