{"id":"CVE-2026-55957","kind":"vulnerability","aliases":["CVE-2026-55957","GHSA-7895-gffq-w6jq"],"related":[],"title":"Apache Tomcat has a Missing Critical Step in Authentication vulnerability","description":"Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without providing the correct password.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.","summary":"When Apache Tomcat's JNDIRealm is configured to authenticate binds using GSSAPI, an attacker can log in without knowing the correct password. The flaw is a missing authentication step in that code path.","severity":"high","cvss":7.3,"epss":0.02855,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":["11.0.5"],"affected":">= 11.0.0-M1, < 11.0.5","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":["10.1.37"],"affected":">= 10.1.0-M1, < 10.1.37","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":["9.0.101"],"affected":">= 9.0.0.M1, < 9.0.101","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":[],"affected":"<= 7.0.109","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["11.0.5"],"affected":">= 11.0.0-M1, < 11.0.5","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["10.1.37"],"affected":">= 10.1.0-M1, < 10.1.37","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["9.0.101"],"affected":">= 9.0.0.M1, < 9.0.101","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":[],"affected":"<= 7.0.109","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":["11.0.5"],"affected":">= 11.0.0-M1, < 11.0.5","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":["10.1.37"],"affected":">= 10.1.0-M1, < 10.1.37","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":["9.0.101"],"affected":">= 9.0.0.M1, < 9.0.101","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":[],"affected":"<= 7.0.109","ecosystem":"maven"},{"name":"apache tomcat","fixed":["9.0.101"],"affected":"< 9.0.101","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["10.1.37"],"affected":">= 10.1.0, < 10.1.37","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["11.0.5"],"affected":">= 11.0.0, < 11.0.5","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["apache-tomcat","cwe-304","java","maven","package","self-hosted"],"not_affected_if":["no-gssapi-bind","no-jndirealm","other-auth-realm"],"how_to_check":"- Check the Tomcat version with `catalina.sh version` or the `tomcat-embed-core` version in your Maven or Gradle dependencies.\n- Look in `conf/server.xml` or `context.xml` for a `JNDIRealm` element that uses GSSAPI bind authentication.","fix":"- Apache Tomcat 11.x: upgrade to `11.0.5`\n- Apache Tomcat 10.1.x: upgrade to `10.1.37`\n- Apache Tomcat 9.0.x: upgrade to `9.0.101`\n- Apache Tomcat 8.5.x and 7.0.x: unknown; the sources list no fixed version for these branches","status":"open","published_at":"2026-06-29T21:16:45+00:00","first_seen_at":"2026-11-04T16:24:14+00:00","triaged_at":"2026-11-04T16:26:26+00:00","updated_at":"2026-11-04T16:28:16+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T16:26:26Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Tomcat 11.x: upgrade to `11.0.5`\n- Apache Tomcat 10.1.x: upgrade to `10.1.37`\n- Apache Tomcat 9.0.x: upgrade to `9.0.101`\n- Apache Tomcat 8.5.x and 7.0.x: unknown; the sources list no fixed version for these branches","reach":"network","title":"Apache Tomcat: JNDIRealm GSSAPI binds let attackers log in without password","impact":"high","summary":"When Apache Tomcat's JNDIRealm is configured to authenticate binds using GSSAPI, an attacker can log in without knowing the correct password. The flaw is a missing authentication step in that code path.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-tomcat","java","maven","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker logs in as a valid user without the password","analyst_note":"Confirm whether Tomcat 8.5.x and 7.0.x have fixed versions, since the sources list none; check the GHSA page at https://github.com/advisories/GHSA-7895-gffq-w6jq.","how_to_check":"- Check the Tomcat version with `catalina.sh version` or the `tomcat-embed-core` version in your Maven or Gradle dependencies.\n- Look in `conf/server.xml` or `context.xml` for a `JNDIRealm` element that uses GSSAPI bind authentication.","plain_action":"","needs_analyst":true,"not_affected_if":["no-jndirealm","no-gssapi-bind","other-auth-realm"],"who_is_affected":"Only deployments that use Tomcat's JNDIRealm with GSSAPI bind authentication are exposed. Applications that authenticate users some other way, or that do not use JNDIRealm, are not affected by this flaw. The sources do not say whether 8.5.x or 7.0.x have a fix.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000857,"input_tokens":4891,"output_tokens":735,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,20A '-304':87B '-55957':13A,21A '-7895':15A '10.1.0':166C '10.1.36':169C '10.1.37':191C '11.0.0':161C '11.0.4':164C '11.0.5':190C '7.0.0':180C '7.0.109':182C '8.5.0':176C '8.5.100':178C '9.0.0':171C '9.0.100':174C '9.0.101':193C 'affect':157C 'allow':146C 'apach':1A,84B,95B,134C,158C 'apache':77A,79A,81A 'apache-tomcat':83B 'attack':107B,147C 'authent':9A,102B,121B,131C,142C,149C 'bind':103B,143C 'catalina':60A,64A,68A,72A,76A 'code':125B 'configur':100B,140C 'core':26A,31A,36A,41A,46A 'correct':114B,153C 'critic':6A,128C 'cve':11A,19A 'cwe':86B 'embed':25A,30A,35A,40A,45A 'fix':195C 'flaw':117B 'gffq':17A 'gffq-w6jq':16A 'ghsa':14A 'gssapi':105B,145C 'host':93B 'issu':156C,197C 'java':88B 'jndirealm':98B,138C 'know':112B 'log':109B 'm1':162C,167C,172C 'maven':89B 'miss':5A,120B,127C 'org.apache.tomcat':47A,49A,51A,53A,55A,57A,61A,65A,69A,73A 'org.apache.tomcat.embed':22A,27A,32A,37A,42A 'packag':90B 'password':115B,154C 'path':126B 'provid':151C 'recommend':185C 'self':92B 'self-host':91B 'step':7A,122B,129C 'tomcat':2A,24A,29A,34A,39A,44A,48A,50A,52A,54A,56A,59A,63A,67A,71A,75A,78A,80A,82A,85B,96B,135C,159C 'tomcat-catalina':58A,62A,66A,70A,74A 'tomcat-embed-core':23A,28A,33A,38A,43A 'upgrad':187C 'use':104B,144C 'user':183C 'version':189C 'vulner':10A,132C 'w6jq':18A 'without':111B,150C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that use Tomcat's JNDIRealm with GSSAPI bind authentication are exposed. Applications that authenticate users some other way, or that do not use JNDIRealm, are not affected by this flaw. The sources do not say whether 8.5.x or 7.0.x have a fix.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apachetomcat","orgapachetomcatembedtomcatembedcore","orgapachetomcattomcat","orgapachetomcattomcatcatalina","tomcat"],"ptokens":["apache","catalina","core","embed","org","tomcat"],"labels":["apachetomcat","cwe304","high","java","maven","package","selfhosted","vendor"],"campaign_type":null,"first_public_at":"2026-06-29T21:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7895-gffq-w6jq","url":"https://github.com/advisories/GHSA-7895-gffq-w6jq","severity":"high","published_at":"2026-06-29T21:32:15+00:00","modified_at":"2026-11-04T16:22:00+00:00","first_seen_at":"2026-11-04T16:24:14+00:00","fetched_at":"2026-11-04T16:29:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-55957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55957","severity":null,"published_at":"2026-06-29T21:16:45+00:00","modified_at":"2026-10-25T21:10:00+00:00","first_seen_at":"2026-11-04T16:28:16+00:00","fetched_at":"2026-11-04T16:28:16+00:00","note":null}],"documents":[{"id":68299,"url":"https://github.com/apache/tomcat/commit/0cd21c0393b8811af22daddbba7b4e7328e2d79e","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68300,"url":"https://github.com/apache/tomcat/commit/c32bbd37ea9ee0aaab848af4ee1c9a76e84240ea","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68301,"url":"https://github.com/apache/tomcat/commit/fd96ab415631eea44636c94f911dd38427070ef9","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68521,"url":"https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh","title":"Vendor advisory: lists.apache.org","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: lists.apache.org"},{"id":68522,"url":"http://www.openwall.com/lists/oss-security/2026/06/29/26","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}